Fix issue where application ID of cloudfoundry.access events is incor…

…rect. (elastic#17847)

* Fix issue where application ID of cloudfoundry.access events is incorrect.

* Add changelog entry.

* Add unit tests for cloudfoundry events.

(cherry picked from commit 08e1b2b)

CHANGELOG.next.asciidoc

@@ -119,6 +119,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fixed a mapping exception when ingesting CEF logs that used the spriv or dpriv extensions. {issue}17216[17216] {pull}17220[17220]
 - Fix issue 17734 to retry on rate-limit error in the Filebeat httpjson input. {issue}17734[17734] {pull}17735[17735]
 - Remove migrationVersion map 7.7.0 reference from Kibana dashboard file to fix backward compatibility issues. {pull}17425[17425]
+- Fixed `cloudfoundry.access` to have the correct `cloudfoundry.app.id` contents. {pull}17847[17847]
 
 *Heartbeat*
 

x-pack/libbeat/common/cloudfoundry/events.go

@@ -5,6 +5,7 @@
 package cloudfoundry
 
 import (
+	"encoding/binary"
 	"fmt"
 	"net/url"
 	"strings"
@@ -377,18 +378,14 @@ func newEventBase(env *events.Envelope) eventBase {
 
 func newEventHttpAccess(env *events.Envelope) *EventHttpAccess {
 	msg := env.GetHttpStartStop()
-	appID := ""
-	if msg.ApplicationId != nil {
-		appID = msg.ApplicationId.String()
-	}
 	return &EventHttpAccess{
 		eventAppBase: eventAppBase{
 			eventBase: newEventBase(env),
-			appGuid:   appID,
+			appGuid:   formatUUID(msg.ApplicationId),
 		},
 		startTimestamp: time.Unix(0, *msg.StartTimestamp),
 		stopTimestamp:  time.Unix(0, *msg.StopTimestamp),
-		requestID:      msg.RequestId.String(),
+		requestID:      formatUUID(msg.RequestId),
 		peerType:       strings.ToLower(msg.PeerType.String()),
 		method:         msg.Method.String(),
 		uri:            *msg.Uri,
@@ -525,3 +522,13 @@ func urlMap(uri string) common.MapStr {
 		"domain":   u.Hostname(),
 	}
 }
+
+func formatUUID(uuid *events.UUID) string {
+	if uuid == nil {
+		return ""
+	}
+	var uuidBytes [16]byte
+	binary.LittleEndian.PutUint64(uuidBytes[:8], uuid.GetLow())
+	binary.LittleEndian.PutUint64(uuidBytes[8:], uuid.GetHigh())
+	return fmt.Sprintf("%x-%x-%x-%x-%x", uuidBytes[0:4], uuidBytes[4:6], uuidBytes[6:8], uuidBytes[8:10], uuidBytes[10:])
+}