Fix azure fields names

CHANGELOG.next.asciidoc

@@ -170,6 +170,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix cisco module's asa and ftd filesets parsing of domain names where an IP address is expected. {issue}14034[14034]
 - Fixed increased memory usage with large files when multiline pattern does not match. {issue}14068[14068]
 - panw module: Use geo.name instead of geo.country_iso_code for free-form location. {issue}13272[13272]
+- Fix azure fields names. {pull}14098[14098]
 
 *Heartbeat*
 

filebeat/docs/fields.asciidoc

@@ -1559,7 +1559,17 @@ type: keyword
 
 --
 
-*`azure.resource.type`*::
+*`azure.resource.provider`*::
++
+--
+Resource type/namespace
+
+
+type: keyword
+
+--
+
+*`azure.resource.namespace`*::
 +
 --
 Resource type/namespace
@@ -1589,21 +1599,21 @@ Fields for Azure activity logs.
 [float]
 === identity
 
-The canonical user ID of the owner of the source bucket.
+Identity
 
 
 
 [float]
 === authorization
 
-Node allocatable pods
+Authorization
 
 
 
 [float]
 === evidence
 
-Node allocatable pods
+Evidence
 
 
 

x-pack/filebeat/module/azure/_meta/fields.yml

@@ -33,7 +33,11 @@
               type: keyword
               description: >
                 Resource group
-            - name: type
+            - name: provider
+              type: keyword
+              description: >
+                Resource type/namespace
+            - name: namespace
               type: keyword
               description: >
                 Resource type/namespace

x-pack/filebeat/module/azure/activitylogs/_meta/fields.yml

@@ -7,17 +7,17 @@
     - name: identity
       type: group
       description: >
-        The canonical user ID of the owner of the source bucket.
+        Identity
       fields:
         - name: authorization
           type: group
           description: >
-            Node allocatable pods
+            Authorization
           fields:
             - name: evidence
               type: group
               description: >
-                Node allocatable pods
+                Evidence
               fields:
                 - name: role_assignment_scope
                   type: keyword

x-pack/filebeat/module/azure/activitylogs/test/activity_log_expected.json

@@ -70,7 +70,7 @@
         "azure" : {
             "subscription_id" : "2a7e2503-d7e2-405a-a84c-c333b9f7cb73",
             "resource" : {
-                "resource_group" : "SA-HEMANT",
+                "group" : "SA-HEMANT",
                 "provider" : "MICROSOFT.EVENTHUB",
                 "namespace" : "AZURELSEVENTS",
                 "id" : "/SUBSCRIPTIONS/2a7e2503-d7e2-405a-a84c-c333b9f7cb73/RESOURCEGROUPS/SA-HEMANT/PROVIDERS/MICROSOFT.EVENTHUB/NAMESPACES/AZURELSEVENTS/AUTHORIZATIONRULES/ROOTMANAGESHAREDACCESSKEY",

x-pack/filebeat/module/azure/azure-shared-pipeline.json

@@ -10,7 +10,7 @@
         {
             "grok": {
                 "field": "azure.resource_id",
-                "patterns": ["/SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.resource_group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/NAMESPACES/%{NAMESPACE:azure.resource.namespace}/AUTHORIZATIONRULES/%{RULE:azure.resource.authorization_rule}"],
+                "patterns": ["/SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/NAMESPACES/%{NAMESPACE:azure.resource.namespace}/AUTHORIZATIONRULES/%{RULE:azure.resource.authorization_rule}"],
                 "pattern_definitions" : {
                     "SUBID" : "(\\{){0,1}[0-9a-fA-F]{8}\\-[0-9a-fA-F]{4}\\-[0-9a-fA-F]{4}\\-[0-9a-fA-F]{4}\\-[0-9a-fA-F]{12}(\\}){0,1}",
                     "GROUPID" : ".+",
@@ -24,7 +24,7 @@
         {
             "grok": {
                 "field": "azure.resource_id",
-                "patterns": ["/SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.resource_group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/%{NAME:azure.resource.name}"],
+                "patterns": ["/SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/%{NAME:azure.resource.name}"],
                 "pattern_definitions" : {
                     "SUBID" : "(\\{){0,1}[0-9a-fA-F]{8}\\-[0-9a-fA-F]{4}\\-[0-9a-fA-F]{4}\\-[0-9a-fA-F]{4}\\-[0-9a-fA-F]{12}(\\}){0,1}",
                     "GROUPID" : ".+",