[Functionbeat] Add ECS categorization fields (elastic#19174)

* Add ECS categorization fields * Add changelog entry
andrewstucki · Jun 18, 2020 · fc5189c · fc5189c
1 parent e465e96
commit fc5189c
Show file tree

Hide file tree

Showing 4 changed files with 75 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -505,7 +505,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Packetbeat*
 
 *Functionbeat*
-
+- Add basic ECS categorization and `cloud` fields. {pull}19174[19174]
 
 *Winlogbeat*
 

diff --git a/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go b/x-pack/functionbeat/provider/aws/aws/transformer/transformer.go
@@ -31,6 +31,12 @@ func CloudwatchLogs(request events.CloudwatchLogsData) []beat.Event {
 		events[idx] = beat.Event{
 			Timestamp: time.Unix(0, logEvent.Timestamp*1000000),
 			Fields: common.MapStr{
+				"event": common.MapStr{
+					"kind": "event",
+				},
+				"cloud": common.MapStr{
+					"provider": "aws",
+				},
 				"message":              logEvent.Message,
 				"id":                   logEvent.ID,
 				"owner":                request.Owner,
@@ -50,6 +56,19 @@ func APIGatewayProxyRequest(request events.APIGatewayProxyRequest) beat.Event {
 	return beat.Event{
 		Timestamp: time.Now(),
 		Fields: common.MapStr{
+			"event": common.MapStr{
+				"kind":     "event",
+				"category": []string{"network"},
+				"type":     []string{"connection", "protocol"},
+			},
+			"cloud": common.MapStr{
+				"provider":   "aws",
+				"account.id": request.RequestContext.AccountID,
+			},
+			"network": common.MapStr{
+				"transport": "tcp",
+				"protocol":  "http",
+			},
 			"resource":          request.Resource,
 			"path":              request.Path,
 			"method":            request.HTTPMethod,
@@ -70,6 +89,13 @@ func KinesisEvent(request events.KinesisEvent) []beat.Event {
 		events[idx] = beat.Event{
 			Timestamp: time.Now(),
 			Fields: common.MapStr{
+				"event": common.MapStr{
+					"kind": "event",
+				},
+				"cloud": common.MapStr{
+					"provider": "aws",
+					"region":   record.AwsRegion,
+				},
 				"event_id":                record.EventID,
 				"event_name":              record.EventName,
 				"event_source":            record.EventSource,
@@ -93,6 +119,13 @@ func CloudwatchKinesisEvent(request events.KinesisEvent, base64Encoded, compress
 	var evts []beat.Event
 	for _, record := range request.Records {
 		envelopeFields := common.MapStr{
+			"event": common.MapStr{
+				"kind": "event",
+			},
+			"cloud": common.MapStr{
+				"provider": "aws",
+				"region":   record.AwsRegion,
+			},
 			"event_id":                record.EventID,
 			"event_name":              record.EventName,
 			"event_source":            record.EventSource,
@@ -157,6 +190,13 @@ func SQS(request events.SQSEvent) []beat.Event {
 		events[idx] = beat.Event{
 			Timestamp: time.Now(),
 			Fields: common.MapStr{
+				"event": common.MapStr{
+					"kind": "event",
+				},
+				"cloud": common.MapStr{
+					"provider": "aws",
+					"region":   record.AWSRegion,
+				},
 				"message_id":       record.MessageId,
 				"receipt_handle":   record.ReceiptHandle,
 				"message":          record.Body,

diff --git a/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go b/x-pack/functionbeat/provider/aws/aws/transformer/transformer_test.go
@@ -40,6 +40,12 @@ func TestCloudwatch(t *testing.T) {
 	expectedEvent := beat.Event{
 		Timestamp: expectedTime,
 		Fields: common.MapStr{
+			"event": common.MapStr{
+				"kind": "event",
+			},
+			"cloud": common.MapStr{
+				"provider": "aws",
+			},
 			"message":              "my interesting message",
 			"id":                   "1234567890123456789",
 			"owner":                "me",
@@ -79,6 +85,13 @@ func TestKinesis(t *testing.T) {
 	assert.Equal(t, 1, len(events))
 
 	fields := common.MapStr{
+		"cloud": common.MapStr{
+			"provider": "aws",
+			"region":   "us-east-1",
+		},
+		"event": common.MapStr{
+			"kind": "event",
+		},
 		"event_id":                "1234",
 		"event_name":              "connect",
 		"event_source":            "web",
@@ -130,6 +143,13 @@ ciJ9XX0=`),
 	assert.Equal(t, 3, len(events))
 
 	envelopeFields := common.MapStr{
+		"cloud": common.MapStr{
+			"provider": "aws",
+			"region":   "us-east-1",
+		},
+		"event": common.MapStr{
+			"kind": "event",
+		},
 		"event_id":                "1234",
 		"event_name":              "connect",
 		"event_source":            "web",

diff --git a/x-pack/functionbeat/provider/gcp/gcp/transformer.go b/x-pack/functionbeat/provider/gcp/gcp/transformer.go
@@ -29,6 +29,12 @@ func transformPubSub(mData *metadata.Metadata, msg pubsub.Message) (beat.Event,
 	return beat.Event{
 		Timestamp: mData.Timestamp,
 		Fields: common.MapStr{
+			"event": common.MapStr{
+				"kind": "event",
+			},
+			"cloud": common.MapStr{
+				"provider": "gcp",
+			},
 			"read_timestamp": time.Now(),
 			"message":        string(msg.Data),
 			"attributes":     msg.Attributes,
@@ -48,6 +54,14 @@ func transformStorage(mData *metadata.Metadata, evt StorageEvent) (beat.Event, e
 	return beat.Event{
 		Timestamp: mData.Timestamp,
 		Fields: common.MapStr{
+			"event": common.MapStr{
+				"kind":     "event",
+				"category": []string{"file"},
+				"type":     []string{"info"},
+			},
+			"cloud": common.MapStr{
+				"provider": "gcp",
+			},
 			"read_timestamp": time.Now(),
 			"id":             mData.EventID,
 			"resource": common.MapStr{