-
Notifications
You must be signed in to change notification settings - Fork 4.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
) Co-authored-by: Noémi Ványi <[email protected]> Co-authored-by: klacabane <[email protected]> (cherry picked from commit 27d44ce) Co-authored-by: Mat Schaffer <[email protected]>
- Loading branch information
1 parent
5eb2a73
commit 3c131c7
Showing
32 changed files
with
881 additions
and
746 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
{"type":"audit", "timestamp":"2022-01-27T14:16:25,271+0100", "node.id":"O8SFUsk8QpGG16JVJcNgUw", "event.type":"transport", "event.action":"access_granted", "authentication.type":"REALM", "user.name":"elastic", "user.realm":"reserved", "user.roles":["superuser"], "origin.type":"rest", "origin.address":"[::1]:64583", "request.id":"yEUG-8deS2y8ZxGgeyeUnw", "action":"indices:admin/create", "request.name":"CreateIndexRequest", "indices":["test_1"], "opaque_id":"myApp1", "trace.id":"0af7651916cd43dd8448eb211c80319c"} | ||
{"type":"audit", "timestamp":"2022-01-27T14:16:28,601+0100", "node.id":"O8SFUsk8QpGG16JVJcNgUw", "event.type":"transport", "event.action":"access_granted", "authentication.type":"REALM", "user.name":"elastic", "user.realm":"reserved", "user.roles":["superuser"], "origin.type":"rest", "origin.address":"[::1]:64583", "request.id":"qo04VI2qRzKrE1dlrsjYgw", "action":"indices:admin/create", "request.name":"CreateIndexRequest", "indices":["test_2"]} | ||
{"type":"audit", "timestamp":"2022-01-27T14:16:30,950+0100", "node.id":"O8SFUsk8QpGG16JVJcNgUw", "event.type":"rest", "event.action":"anonymous_access_denied", "origin.type":"rest", "origin.address":"[::1]:64583", "url.path":"/test_3", "request.method":"PUT", "request.id":"0ybRdKGYRAekov1eKI6nIw", "opaque_id":"myApp1", "trace.id":"0af7651916cd43dd8448eb211c80319c"} |
105 changes: 105 additions & 0 deletions
105
filebeat/module/elasticsearch/audit/test/test-audit-800.log-expected.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,105 @@ | ||
[ | ||
{ | ||
"@timestamp": "2022-01-27T13:16:25.271Z", | ||
"elasticsearch.audit.action": "indices:admin/create", | ||
"elasticsearch.audit.authentication.type": "REALM", | ||
"elasticsearch.audit.indices": [ | ||
"test_1" | ||
], | ||
"elasticsearch.audit.layer": "transport", | ||
"elasticsearch.audit.opaque_id": "myApp1", | ||
"elasticsearch.audit.origin.type": "rest", | ||
"elasticsearch.audit.request.id": "yEUG-8deS2y8ZxGgeyeUnw", | ||
"elasticsearch.audit.request.name": "CreateIndexRequest", | ||
"elasticsearch.audit.user.realm": "reserved", | ||
"elasticsearch.audit.user.roles": [ | ||
"superuser" | ||
], | ||
"elasticsearch.node.id": "O8SFUsk8QpGG16JVJcNgUw", | ||
"event.action": "access_granted", | ||
"event.category": "database", | ||
"event.dataset": "elasticsearch.audit", | ||
"event.kind": "event", | ||
"event.module": "elasticsearch", | ||
"event.outcome": "success", | ||
"fileset.name": "audit", | ||
"host.id": "O8SFUsk8QpGG16JVJcNgUw", | ||
"http.request.id": "yEUG-8deS2y8ZxGgeyeUnw", | ||
"input.type": "log", | ||
"log.offset": 0, | ||
"message": "{\"type\":\"audit\", \"timestamp\":\"2022-01-27T14:16:25,271+0100\", \"node.id\":\"O8SFUsk8QpGG16JVJcNgUw\", \"event.type\":\"transport\", \"event.action\":\"access_granted\", \"authentication.type\":\"REALM\", \"user.name\":\"elastic\", \"user.realm\":\"reserved\", \"user.roles\":[\"superuser\"], \"origin.type\":\"rest\", \"origin.address\":\"[::1]:64583\", \"request.id\":\"yEUG-8deS2y8ZxGgeyeUnw\", \"action\":\"indices:admin/create\", \"request.name\":\"CreateIndexRequest\", \"indices\":[\"test_1\"], \"opaque_id\":\"myApp1\", \"trace.id\":\"0af7651916cd43dd8448eb211c80319c\"}", | ||
"related.user": [ | ||
"elastic" | ||
], | ||
"service.type": "elasticsearch", | ||
"source.address": "[::1]:64583", | ||
"source.ip": "::1", | ||
"source.port": 64583, | ||
"trace.id": "0af7651916cd43dd8448eb211c80319c", | ||
"user.name": "elastic" | ||
}, | ||
{ | ||
"@timestamp": "2022-01-27T13:16:28.601Z", | ||
"elasticsearch.audit.action": "indices:admin/create", | ||
"elasticsearch.audit.authentication.type": "REALM", | ||
"elasticsearch.audit.indices": [ | ||
"test_2" | ||
], | ||
"elasticsearch.audit.layer": "transport", | ||
"elasticsearch.audit.origin.type": "rest", | ||
"elasticsearch.audit.request.id": "qo04VI2qRzKrE1dlrsjYgw", | ||
"elasticsearch.audit.request.name": "CreateIndexRequest", | ||
"elasticsearch.audit.user.realm": "reserved", | ||
"elasticsearch.audit.user.roles": [ | ||
"superuser" | ||
], | ||
"elasticsearch.node.id": "O8SFUsk8QpGG16JVJcNgUw", | ||
"event.action": "access_granted", | ||
"event.category": "database", | ||
"event.dataset": "elasticsearch.audit", | ||
"event.kind": "event", | ||
"event.module": "elasticsearch", | ||
"event.outcome": "success", | ||
"fileset.name": "audit", | ||
"host.id": "O8SFUsk8QpGG16JVJcNgUw", | ||
"http.request.id": "qo04VI2qRzKrE1dlrsjYgw", | ||
"input.type": "log", | ||
"log.offset": 517, | ||
"message": "{\"type\":\"audit\", \"timestamp\":\"2022-01-27T14:16:28,601+0100\", \"node.id\":\"O8SFUsk8QpGG16JVJcNgUw\", \"event.type\":\"transport\", \"event.action\":\"access_granted\", \"authentication.type\":\"REALM\", \"user.name\":\"elastic\", \"user.realm\":\"reserved\", \"user.roles\":[\"superuser\"], \"origin.type\":\"rest\", \"origin.address\":\"[::1]:64583\", \"request.id\":\"qo04VI2qRzKrE1dlrsjYgw\", \"action\":\"indices:admin/create\", \"request.name\":\"CreateIndexRequest\", \"indices\":[\"test_2\"]}", | ||
"related.user": [ | ||
"elastic" | ||
], | ||
"service.type": "elasticsearch", | ||
"source.address": "[::1]:64583", | ||
"source.ip": "::1", | ||
"source.port": 64583, | ||
"user.name": "elastic" | ||
}, | ||
{ | ||
"@timestamp": "2022-01-27T13:16:30.950Z", | ||
"elasticsearch.audit.layer": "rest", | ||
"elasticsearch.audit.opaque_id": "myApp1", | ||
"elasticsearch.audit.origin.type": "rest", | ||
"elasticsearch.audit.request.id": "0ybRdKGYRAekov1eKI6nIw", | ||
"elasticsearch.node.id": "O8SFUsk8QpGG16JVJcNgUw", | ||
"event.action": "anonymous_access_denied", | ||
"event.category": "database", | ||
"event.dataset": "elasticsearch.audit", | ||
"event.kind": "event", | ||
"event.module": "elasticsearch", | ||
"event.outcome": "failure", | ||
"fileset.name": "audit", | ||
"host.id": "O8SFUsk8QpGG16JVJcNgUw", | ||
"http.request.id": "0ybRdKGYRAekov1eKI6nIw", | ||
"http.request.method": "PUT", | ||
"input.type": "log", | ||
"log.offset": 965, | ||
"message": "{\"type\":\"audit\", \"timestamp\":\"2022-01-27T14:16:30,950+0100\", \"node.id\":\"O8SFUsk8QpGG16JVJcNgUw\", \"event.type\":\"rest\", \"event.action\":\"anonymous_access_denied\", \"origin.type\":\"rest\", \"origin.address\":\"[::1]:64583\", \"url.path\":\"/test_3\", \"request.method\":\"PUT\", \"request.id\":\"0ybRdKGYRAekov1eKI6nIw\", \"opaque_id\":\"myApp1\", \"trace.id\":\"0af7651916cd43dd8448eb211c80319c\"}", | ||
"service.type": "elasticsearch", | ||
"source.address": "[::1]:64583", | ||
"source.ip": "::1", | ||
"source.port": 64583, | ||
"trace.id": "0af7651916cd43dd8448eb211c80319c", | ||
"url.original": "/test_3" | ||
} | ||
] |
97 changes: 97 additions & 0 deletions
97
filebeat/module/elasticsearch/deprecation/ingest/pipeline-json-7.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,97 @@ | ||
description: Pipeline for parsing the Elasticsearch deprecation log file in JSON format. | ||
on_failure: | ||
- set: | ||
field: error.message | ||
value: '{{ _ingest.on_failure_message }}' | ||
processors: | ||
- json: | ||
field: message | ||
target_field: elasticsearch.deprecation | ||
- drop: | ||
if: '!["deprecation", "deprecation.elasticsearch"].contains(ctx.elasticsearch.deprecation.type)' | ||
- remove: | ||
field: elasticsearch.deprecation.type | ||
- dot_expander: | ||
field: service.name | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.service.name | ||
target_field: service.name | ||
ignore_missing: true | ||
- rename: | ||
field: elasticsearch.deprecation.level | ||
target_field: log.level | ||
ignore_missing: true | ||
- dot_expander: | ||
field: log.level | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.log.level | ||
target_field: log.level | ||
ignore_missing: true | ||
- dot_expander: | ||
field: log.logger | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.log.logger | ||
target_field: log.logger | ||
ignore_missing: true | ||
- dot_expander: | ||
field: process.thread.name | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.process.thread.name | ||
target_field: process.thread.name | ||
ignore_missing: true | ||
- rename: | ||
field: elasticsearch.deprecation.component | ||
target_field: elasticsearch.component | ||
ignore_missing: true | ||
- dot_expander: | ||
field: cluster.name | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.cluster.name | ||
target_field: elasticsearch.cluster.name | ||
- dot_expander: | ||
field: node.name | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.node.name | ||
target_field: elasticsearch.node.name | ||
- dot_expander: | ||
field: cluster.uuid | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.cluster.uuid | ||
target_field: elasticsearch.cluster.uuid | ||
ignore_missing: true | ||
- dot_expander: | ||
field: node.id | ||
path: elasticsearch.deprecation | ||
- rename: | ||
field: elasticsearch.deprecation.node.id | ||
target_field: elasticsearch.node.id | ||
ignore_missing: true | ||
- remove: | ||
field: message | ||
- rename: | ||
field: elasticsearch.deprecation.message | ||
target_field: message | ||
- date: | ||
field: 'elasticsearch.deprecation.@timestamp' | ||
formats: | ||
- ISO8601 | ||
ignore_failure: true | ||
if: 'ctx.elasticsearch?.deprecation["@timestamp"] != null' | ||
- date: | ||
field: 'elasticsearch.deprecation.timestamp' | ||
formats: | ||
- ISO8601 | ||
ignore_failure: true | ||
if: 'ctx.elasticsearch?.deprecation?.timestamp != null' | ||
- remove: | ||
field: | ||
- elasticsearch.deprecation.timestamp | ||
- elasticsearch.deprecation.@timestamp | ||
ignore_missing: true |
15 changes: 15 additions & 0 deletions
15
filebeat/module/elasticsearch/deprecation/ingest/pipeline-json-8.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,15 @@ | ||
description: Pipeline for parsing the Elasticsearch deprecation log file in JSON format. | ||
on_failure: | ||
- set: | ||
field: error.message | ||
value: '{{ _ingest.on_failure_message }}' | ||
processors: | ||
- json: | ||
field: message | ||
add_to_root: true | ||
- dot_expander: | ||
field: '*' | ||
override: true | ||
- set: | ||
field: event.dataset | ||
value: elasticsearch.deprecation |
Oops, something went wrong.