From c5ef8ed9a3920a02f293b49e0e20458186ee63ef Mon Sep 17 00:00:00 2001
From: Andrew Kroh <andrew.kroh@elastic.co>
Date: Wed, 24 Mar 2021 11:07:40 -0400
Subject: [PATCH] Fix gcp/vpcflow module defaulting to file input (#24719)

The pubsub input was renamed from google-pubsub to gcp-pubsub and the vpcflow filesets manifest
was not updated. As a result it's defaulting to the file input. This fixes the manifest.

The workaround is to explicitly set the input type:

    vpcflow:
      enabled: true
      var.input: gcp-pubsub
---
 CHANGELOG.next.asciidoc                         | 3 ++-
 x-pack/filebeat/module/gcp/vpcflow/manifest.yml | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index c53baf79381..d000980b026 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -374,7 +374,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix Cisco ASA parser for message 722051. {pull}24410[24410]
 - Fix `google_workspace` pagination. {pull}24668[24668]
 - Fix Cisco ASA parser for message 302022. {issue}24405[24405] {pull}24697[24697]
-- Fix date parsing in GSuite/login fileset. {issue}24694[24694]
+- Fix gcp/vpcflow module error where input type was defaulting to file. {pull}24719[24719]
+- Fix date parsing in GSuite/login and Google Workspace/login filesets. {issue}24694[24694]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/module/gcp/vpcflow/manifest.yml b/x-pack/filebeat/module/gcp/vpcflow/manifest.yml
index 1f67548e0db..4cd314d574f 100644
--- a/x-pack/filebeat/module/gcp/vpcflow/manifest.yml
+++ b/x-pack/filebeat/module/gcp/vpcflow/manifest.yml
@@ -2,7 +2,7 @@ module_version: "1.0"
 
 var:
   - name: input
-    default: google-pubsub
+    default: gcp-pubsub
   - name: project_id
     default: SET_PROJECT_NAME
   - name: topic