From 825bfb2e505ede0e0c39a79bcdf89f4a50a9c723 Mon Sep 17 00:00:00 2001 From: Leandro Maciel Date: Fri, 3 Sep 2021 04:49:52 -0300 Subject: [PATCH] [filebeat] fix crowdstrike ingest pipeline (#27623) * fix: fix crowdstrike ingest pipeline fix process fields that were being created as flattened fields * docs: add line to changelog.next added line about the pr in the changelog.next file * docs: add links in changelog corrected the links to the issue and pr in changelog * Update CHANGELOG.next.asciidoc Fixed capitalization. --- CHANGELOG.next.asciidoc | 1 + .../filebeat/module/crowdstrike/falcon/ingest/pipeline.yml | 7 ++++--- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index f5252af0951..0ae97dd2033 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -82,6 +82,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - threatintel module: Changed the type of `threatintel.indicator.first_seen` from `keyword` to `date`. {pull}26765[26765] - Remove all alias fields pointing to ECS fields from modules. This affects the Suricata and Traefik modules. {issue}10535[10535] {pull}26627[26627] - Add option for S3 input to work without SQS notification {issue}18205[18205] {pull}27332[27332] +- Fix Crowdstrike ingest pipeline that was creating flattened `process` fields. {issue}27622[27622] {pull}27623[27623] *Heartbeat* - Remove long deprecated `watch_poll` functionality. {pull}27166[27166] diff --git a/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml b/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml index 7e7efe5cd74..9aeb653b488 100644 --- a/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml +++ b/x-pack/filebeat/module/crowdstrike/falcon/ingest/pipeline.yml @@ -284,9 +284,10 @@ processors: def args = Arrays.asList(/ /.split(commandLine)); args.removeIf(arg -> arg == ""); - ctx["process.command_line"] = commandLine; - ctx["process.args"] = args; - ctx["process.executable"] = args.get(0); + ctx['process'] = new HashMap(); + ctx.process.command_line = commandLine; + ctx.process.args = args; + ctx.process.executable = args.get(0); } } - pipeline: