The socket.entity_id field was removed in 7.4.0 (#32316) (#32389)

* The socket.entity_id field was removed in 7.4.0 see - #17346 * Remove socket.entity_id field from fields.yml Co-authored-by: dedemorton <[email protected]> (cherry picked from commit ccee622) Co-authored-by: Daisuke Harada <[email protected]>
elastic · Jul 18, 2022 · 40d35c0 · 40d35c0
1 parent 08168b7
commit 40d35c0
Show file tree

Hide file tree

Showing 3 changed files with 1 addition and 21 deletions.
diff --git a/auditbeat/docs/fields.asciidoc b/auditbeat/docs/fields.asciidoc
@@ -17600,17 +17600,6 @@ type: keyword
 --
 XX64 hash of the executable.
 
-type: keyword
-
---
-
-
-*`socket.entity_id`*::
-+
---
-ID uniquely identifying the socket. It is computed as a SHA-256 hash of the host ID, socket inode, local IP, local port, remote IP, and remote port.
-
-
 type: keyword
 
 --

diff --git a/x-pack/auditbeat/module/system/_meta/fields.yml b/x-pack/auditbeat/module/system/_meta/fields.yml
@@ -85,15 +85,6 @@
         type: keyword
         description: XX64 hash of the executable.
 
-  - name: socket
-    type: group
-    fields:
-    - name: entity_id
-      type: keyword
-      description: >
-        ID uniquely identifying the socket. It is computed as a SHA-256 hash of the
-        host ID, socket inode, local IP, local port, remote IP, and remote port.
-
   - name: system.audit
     type: group
     description: >

diff --git a/x-pack/auditbeat/module/system/fields.go b/x-pack/auditbeat/module/system/fields.go