Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Finalize user_agent migration to ECS #10441

Merged
merged 7 commits into from
Feb 4, 2019
Merged

Finalize user_agent migration to ECS #10441

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0c839c9
Remove unnecessary field renames, after user_agent adjustment to ECS
Jan 31, 2019
e373c62
Remove user agent's old major/minor/patch fields
Jan 31, 2019
183984e
Remove small mistake in ecs-migration
Jan 31, 2019
192d2d2
Remove obsolete comment
Jan 31, 2019
7d3cd94
Correct inconsistencies in ecs-migration wrt user_agent field migration.
Jan 31, 2019
3c0af2d
Unskip the Filebeat integration tests. User_agent parsing is now good…
Feb 4, 2019
9b418df
Remove original suricata user_agent field (now alias), update x-pack …
Feb 4, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 0 additions & 50 deletions auditbeat/docs/fields.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5828,56 +5828,6 @@ type: keyword
Hostname of the agent.


--

*`user_agent.patch`*::
+
--
type: keyword

Patch version of the user agent.


--

*`user_agent.minor`*::
+
--
type: keyword

Minor version of the user agent.


--

*`user_agent.major`*::
+
--
type: keyword

Major version of the user agent.


--

*`user_agent.os.major`*::
+
--
type: long

Major version of the operating system.


--

*`user_agent.os.minor`*::
+
--
type: long

Minor version of the operating system.


--

[[exported-fields-file_integrity]]
Expand Down
2 changes: 1 addition & 1 deletion auditbeat/include/fields.go
View file
Open in desktop

Large diffs are not rendered by default.

181 changes: 130 additions & 51 deletions dev-tools/ecs-migration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -588,7 +588,6 @@
to: http.response.body.bytes
alias: true

# These expand all fields under geoip and user_agent
- from: apache2.access.geoip.continent_name
to: source.geo.continent_name
alias: true
Expand Down Expand Up @@ -619,49 +618,50 @@
alias: true
beat: filebeat

- from: apache2.access.user_agent.device
to: user_agent.device
alias: true
beat: filebeat

- from: apache2.access.user_agent.major
to: user_agent.major
- from: apache2.access.user_agent.original
to: user_agent.original
alias: true
beat: filebeat

- from: apache2.access.user_agent.minor
to: user_agent.minor
- from: apache2.access.user_agent.device
to: user_agent.device.name
alias: true
beat: filebeat

- from: apache2.access.user_agent.name
to: user_agent.name
alias: true
beat: filebeat

- from: apache2.access.user_agent.original
to: user_agent.original
alias: true
beat: filebeat

- from: apache2.access.user_agent.os
to: user_agent.os.full_name
alias: true
beat: filebeat

- from: apache2.access.user_agent.os_name
to: user_agent.os.name
alias: true
beat: filebeat

- from: apache2.access.user_agent.major
to: user_agent.version
alias: false
beat: filebeat
- from: apache2.access.user_agent.minor
to: user_agent.version
alias: false
beat: filebeat
- from: apache2.access.user_agent.patch
to: user_agent.patch
alias: true
to: user_agent.version
alias: false
beat: filebeat

- from: apache2.access.user_agent.user_name
to: user.name
alias: true
- from: apache2.access.user_agent.os_major
to: user_agent.os.version
alias: false
beat: filebeat
- from: apache2.access.user_agent.os_minor
to: user_agent.os.version
alias: false
beat: filebeat
- from: apache2.access.user_agent.os_patch
to: user_agent.os.version
alias: false
beat: filebeat

### Error fileset
Expand Down Expand Up @@ -763,6 +763,47 @@
to: user_agent.original
alias: true
beat: filebeat
- from: iis.access.user_agent.device
to: user_agent.device.name
alias: true
beat: filebeat
- from: iis.access.user_agent.name
to: user_agent.name
alias: true
beat: filebeat
- from: iis.access.user_agent.os
to: user_agent.os.full_name
alias: true
beat: filebeat
- from: iis.access.user_agent.os_name
to: user_agent.os.name
alias: true
beat: filebeat

- from: iis.access.user_agent.major
to: user_agent.version
alias: false
beat: filebeat
- from: iis.access.user_agent.minor
to: user_agent.version
alias: false
beat: filebeat
- from: iis.access.user_agent.patch
to: user_agent.version
alias: false
beat: filebeat
- from: iis.access.user_agent.os_major
to: user_agent.os.version
alias: false
beat: filebeat
- from: iis.access.user_agent.os_minor
to: user_agent.os.version
alias: false
beat: filebeat
- from: iis.access.user_agent.os_patch
to: user_agent.os.version
alias: false
beat: filebeat

- from: iis.access.geoip.continent_name
to: source.geo.continent_name
Expand Down Expand Up @@ -1187,6 +1228,48 @@
alias: true
beat: filebeat

- from: nginx.access.user_agent.device
to: user_agent.device.name
alias: true
beat: filebeat
- from: nginx.access.user_agent.name
to: user_agent.name
alias: true
beat: filebeat
- from: nginx.access.user_agent.os
to: user_agent.os.full_name
alias: true
beat: filebeat
- from: nginx.access.user_agent.os_name
to: user_agent.os.name
alias: true
beat: filebeat

- from: nginx.access.user_agent.major
to: user_agent.version
alias: false
beat: filebeat
- from: nginx.access.user_agent.minor
to: user_agent.version
alias: false
beat: filebeat
- from: nginx.access.user_agent.patch
to: user_agent.version
alias: false
beat: filebeat
- from: nginx.access.user_agent.os_major
to: user_agent.os.version
alias: false
beat: filebeat
- from: nginx.access.user_agent.os_minor
to: user_agent.os.version
alias: false
beat: filebeat
- from: nginx.access.user_agent.os_patch
to: user_agent.os.version
alias: false
beat: filebeat

- from: nginx.error.level
to: log.level
alias: true
Expand Down Expand Up @@ -1314,50 +1397,46 @@
to: user_agent.original
alias: true
beat: filebeat

- from: traefik.access.user_agent.device
to: user_agent.device
alias: true
beat: filebeat

- from: traefik.access.user_agent.major
to: user_agent.major
alias: true
beat: filebeat

- from: traefik.access.user_agent.minor
to: user_agent.minor
to: user_agent.device.name
alias: true
beat: filebeat

- from: traefik.access.user_agent.name
to: user_agent.name
alias: true
beat: filebeat

- from: traefik.access.user_agent.original
to: user_agent.original
alias: true
beat: filebeat

- from: traefik.access.user_agent.os
to: user_agent.os.full_name
alias: true
beat: filebeat

- from: traefik.access.user_agent.os_name
to: user_agent.os.name
alias: true
beat: filebeat

- from: traefik.access.user_agent.major
to: user_agent.version
alias: false
beat: filebeat
- from: traefik.access.user_agent.minor
to: user_agent.version
alias: false
beat: filebeat
- from: traefik.access.user_agent.patch
to: user_agent.patch
alias: true
to: user_agent.version
alias: false
beat: filebeat

- from: traefik.access.user_agent.user_name
to: user.name
alias: true
- from: traefik.access.user_agent.os_major
to: user_agent.os.version
alias: false
beat: filebeat
- from: traefik.access.user_agent.os_minor
to: user_agent.os.version
alias: false
beat: filebeat
- from: traefik.access.user_agent.os_patch
to: user_agent.os.version
alias: false
beat: filebeat

- from: traefik.access.geoip.continent_name
Expand Down
Loading