[Auditbeat] Cherry-pick #9732 to 6.6: User metricset: Fetch groups by user #9872
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Changes the user metricset to looking up groups by user instead of users by groups. Also changes the types of the system.audit.user.uid and system.audit.user.gid fields from integer to keyword to accommodate Windows in the future. Fixes elastic#9679. (cherry picked from commit 42421e9)
cwurm
changed the title
|
Pinging @elastic/secops |
andrewkroh
approved these changes
Jan 3, 2019
leweafan
pushed a commit
to leweafan/beats
that referenced
this pull request
Apr 28, 2023
…oups by user (elastic#9872) Cherry-pick of PR elastic#9732 to 6.6 branch. Original message: Changes the user metricset to looking up groups by user instead of users by groups. Also changes the types of the system.audit.user.uid and system.audit.user.gid fields from integer to keyword to accommodate Windows in the future. Fixes elastic#9679.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry-pick of PR #9732 to 6.6 branch. Original message:
Currently, the
usermetricset reads all users, then reads all groups and their members and matches one to the other. This can be a problem when groups have a lot of members (see #9679).This changes to looking up groups of individual users.
It also changes the types of the
system.audit.user.uidandsystem.audit.user.gidfields fromintegertokeywordto accommodate Windows in the future (Go'sUserandGroupstructs usestrings, so does ECSuser.id/group.id).Because the internal structure of the
Userstruct changes, this invalidates previousbeat.dbfiles. I have not added any conversion logic this time since this metricset is not released yet - but we will have to do it in the future.Fixes #9679.