-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Filebeat][httpjson] Add date_cursor to httpjson input #19483
[Filebeat][httpjson] Add date_cursor to httpjson input #19483
Conversation
Pinging @elastic/siem (Team:SIEM) |
300e894
to
e4a5c6a
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Few comments but except that LGTM, though would need more reviews than me.
Tested this with the ATP module and seems to be working just fine |
9fc80d0
to
d4b655a
Compare
Added |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. Looks like it covers exactly the cases needed for now.
d4b655a
to
09d408a
Compare
3c9b5e0
to
d04d3fe
Compare
* Add date_cursor to httpjson input * Add changelog entry * Fix tests * Default to UTC date * Add date_cursor validations and better error message * Run fmt update (cherry picked from commit 775f134)
* Add date_cursor to httpjson input * Add changelog entry * Fix tests * Default to UTC date * Add date_cursor validations and better error message * Run fmt update
What does this PR do?
Adds the ability to set a
date_cursor
inhttpjson
input. This can be used to make date based requests to the endpoint.Why is it important?
To prevent requesting big amounts of events, or repeated events from APIs.
Checklist
- [ ] I have made corresponding changes to the documentation- [ ] I have made corresponding change to the default configuration filesCHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Not sure if adding it to docs or not, since this is meant for very specific use cases for now.