Add additional fields to address issue #18465 for googlecloud audit log #18472
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
botelastic
bot
added
the
needs_team
|
Pinging @elastic/siem (Team:SIEM) |
botelastic
bot
removed
the
needs_team
alakahakai
changed the title
alakahakai
changed the title
❕ Build Aborted
Expand to view the summary
Build stats
Log outputExpand to view the last 100 lines of log output
|
|
run tests |
alakahakai
added
the
needs_backport
andrewkroh
reviewed
May 14, 2020
There was a problem hiding this comment.
Can you please add a changelog entry.
It would be helpful to include some details in the PR description to describe how it addresses the issue.
IIUC what has changed is that the module no longer moves all of the raw fields into the googlecloud.audit namespace, and now is more selective about only copying fields that are mapped. And this prevent any dynamic mapping conflicts. The implication being that some fields that may have been previously copied over are now dropped, but since we have the var.keep_original_message module option this is mitigated. Hopefully I followed correctly 😬 .
Yes, you are correct. The fields have changed recently and these fields don't have defined data models and just used a struct, which caused the issue. The googlecloud.audit dataset now only take in the fields that are defined by the dataset. |
andrewkroh
approved these changes
May 14, 2020
alakahakai
added
v7.8.0
and removed
needs_backport
v1v
added a commit
to v1v/beats
that referenced
this pull request
May 15, 2020
…w-oss * upstream/master: (27 commits) Disable host fields for "cloud", panw, cef modules (elastic#18223) [docs] Rename monitoring collection from legacy internal collection to legacy collection (elastic#18504) Introduce auto detection of format (elastic#18095) Add additional fields to address issue elastic#18465 for googlecloud audit log (elastic#18472) Fix libbeat import path in seccomp policy template (elastic#18418) Address Okta input issue elastic#18530 (elastic#18534) [Ingest Manager] Avoid Chown on windows (elastic#18512) Fix Cisco ASA/FTD msgs that use a host name as NAT address (elastic#18376) [CI] Optimise stash/unstash performance (elastic#18473) Libbeat: Remove global loggers from libbeat/metric and libbeat/cloudid (elastic#18500) Fix PANW bad mapping of client/source and server/dest packets and bytes (elastic#18525) Add a file lock to the data directory on startup to prevent multiple agents. (elastic#18483) Followup to 12606 (elastic#18316) changed input from syslog to tcp/udp due to unsupported RFC (elastic#18447) Improve ECS field mappings in Sysmon module. (elastic#18381) [Elastic Agent] Cleaner output of inspect command (elastic#18405) [Elastic Agent] Pick up version from libbeat (elastic#18350) Update communitybeats.asciidoc (elastic#18470) [Metricbeat] Change visualization interval from 15m to >=15m (elastic#18466) docs: Fix typo in kerberos docs (elastic#18503) ...
leweafan
pushed a commit
to leweafan/beats
that referenced
this pull request
Apr 28, 2023
…sue elastic#18465 for googlecloud audit log (elastic#18554) * Add additional fields to address issue elastic#18465 for googlecloud audit log (elastic#18472)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Address issue #18465
The returned fields from googlecloud audit logs have changed recently. These fields don't have defined data models and just use a struct, which caused the issue. With this PR, the googlecloud.audit dataset now only take in the fields that are defined by the dataset.