Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] Improve ECS categorization mappings in envoyproxy module. #18395

Merged
merged 3 commits into from
May 15, 2020

Conversation

leehinman
Copy link
Contributor

What does this PR do?

Improves ECS categorization mappings in envoyproxy module.
Specifically:

  • convert pipeline to yaml
  • event.category
  • event.kind
  • event.outcome
  • event.type
  • network.protocol
  • network.transport
  • related.ip

Why is it important?

Improved ECS categorization improves usability of the data in the SIEM and makes cross correlation between data sources easier.

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=envoyproxy mage -v pythonIntegTest

Related issues

@leehinman leehinman added enhancement Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. Team:SIEM ecs labels May 8, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 8, 2020
- convert pipeline to yaml
- event.category
- event.kind
- event.outcome
- event.type
- network.protocol
- network.transport
- related.ip

Closes elastic#16161
@leehinman leehinman force-pushed the 16161_envoyproxy_ecs_1.4 branch from 9b161eb to 0f7cd02 Compare May 8, 2020 19:22
@elasticmachine
Copy link
Collaborator

elasticmachine commented May 8, 2020

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [leehinman commented: run tests]

  • Start Time: 2020-05-14T18:26:08.269+0000

  • Duration: 48 min 43 sec (2863323)

Test stats 🧪

Test Results
Failed 0
Passed 1184
Skipped 128
Total 1312

@andresrc andresrc removed the needs_team Indicates that the issue/PR needs a Team:* label label May 9, 2020
@leehinman
Copy link
Contributor Author

run tests

Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@leehinman leehinman merged commit 7c3e38d into elastic:master May 15, 2020
@leehinman leehinman added v7.9.0 and removed needs_backport PR is waiting to be backported to other branches. labels May 15, 2020
leehinman added a commit to leehinman/beats that referenced this pull request May 15, 2020
…lastic#18395)

* Improve ECS categorization mappings in envoyproxy module.

- convert pipeline to yaml
- explicitly set ECS version
- event.category
- event.kind
- event.outcome
- event.type
- network.protocol
- network.transport
- related.ip

Closes elastic#16161

(cherry picked from commit 7c3e38d)
@leehinman leehinman deleted the 16161_envoyproxy_ecs_1.4 branch May 15, 2020 13:29
leehinman added a commit that referenced this pull request May 18, 2020
…18395) (#18577)

* Improve ECS categorization mappings in envoyproxy module.

- convert pipeline to yaml
- explicitly set ECS version
- event.category
- event.kind
- event.outcome
- event.type
- network.protocol
- network.transport
- related.ip

Closes #16161

(cherry picked from commit 7c3e38d)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Filebeat] Upgrade envoyproxy module to ECS 1.4
4 participants