Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for GMT timezone offset in decode_cef #20993

Merged
merged 2 commits into from
Sep 10, 2020
Merged

Add support for GMT timezone offset in decode_cef #20993

merged 2 commits into from
Sep 10, 2020

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented Sep 4, 2020 •
edited by andresrc
Loading

What does this PR do?

The Java SimpleDataFormat's zzz allows for GMT-07:00 in timestamps
but this wasn't handled in the processor.

Why is it important?

The processor should be able to parse all formats in the specification.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Sep 4, 2020
@andrewkroh
Add support for GMT timezone offset in decode_cef
1f540bd 
The Java SimpleDataFormat's `zzz` allows for `GMT-07:00` in timestamps
but this wasn't handled in the processor.
@andrewkroh andrewkroh force-pushed the feature/fb/cef-ts-gmt-offset branch from 96e0a0a to 1f540bd Compare September 4, 2020 20:20
@elasticmachine
Copy link
Collaborator

elasticmachine commented Sep 4, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20993 updated]

  • Start Time: 2020-09-10T19:58:15.795+0000

  • Duration: 53 min 44 sec

Test stats 🧪

Test Results
Failed 0
Passed 2474
Skipped 388
Total 2862

@andrewkroh andrewkroh merged commit 6cfee0c into elastic:master Sep 10, 2020
@andrewkroh andrewkroh added the needs_backport PR is waiting to be backported to other branches. label Sep 10, 2020
@andrewkroh andrewkroh mentioned this pull request Sep 10, 2020
Merged
6 tasks
@andrewkroh andrewkroh removed the needs_backport PR is waiting to be backported to other branches. label Sep 10, 2020
@andrewkroh andrewkroh mentioned this pull request Sep 10, 2020
Merged
6 tasks
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Sep 10, 2020
@andrewkroh
Add support for GMT timezone offset in decode_cef (elastic#20993)
552e44f 
The Java SimpleDataFormat's `zzz` allows for `GMT-07:00` in timestamps
but this wasn't handled in the processor.

(cherry picked from commit 6cfee0c)
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Sep 10, 2020
@andrewkroh
Add support for GMT timezone offset in decode_cef (elastic#20993)
9998936 
The Java SimpleDataFormat's `zzz` allows for `GMT-07:00` in timestamps
but this wasn't handled in the processor.

(cherry picked from commit 6cfee0c)
v1v added a commit to v1v/beats that referenced this pull request Sep 14, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/windows-10
cc07c42 
* upstream/master: (362 commits)
  Add vendoring to Google Cloud Functions again (elastic#21070)
  [Elastic Agent] Add fleet.host.id for sending to endpoint. (elastic#21042)
  Do not need Google credentials before using it (elastic#21072)
  [Filebeat][New Module] Zoom webhook module (elastic#20414)
  Add support for GMT timezone offset in decode_cef (elastic#20993)
  Filebeat: Fix random error on harvester close (elastic#21048)
  Add ingress controller dashboards (elastic#21052)
  Fix loggers in composable module. (elastic#21047)
  [Ingest Manager] Increase kibana client timeout to 5 minutes (elastic#21037)
  Add changelog. (elastic#21041)
  [Elastic Agent] Add support for EQL based conditions (elastic#20994)
  Disable Kafka metricsets based on Jolokia (elastic#20989)
  Update apm agent (elastic#21031)
  Add container ECS fields in kubernetes metadata (elastic#20984)
  Sanitize event.host in Metricbeat (elastic#21022)
  Update api-keys.asciidoc - API key prerequisites (elastic#21026)
  [Filebeat][suricata] Map x509 for suricata/eve fileset (elastic#20973)
  [Filebeat][santa] Map x509 fields in santa module (elastic#20976)
  [Filebeat][fortinet] Map x509 ecs fields for fortinet fw fileset (elastic#20983)
  Bump zeek kerberos/ssl/x509 ecs version (elastic#21003)
  ...
v1v added a commit to v1v/beats that referenced this pull request Sep 14, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/windows-7-64
fcc41b4 
* upstream/master: (364 commits)
  Add vendoring to Google Cloud Functions again (elastic#21070)
  [Elastic Agent] Add fleet.host.id for sending to endpoint. (elastic#21042)
  Do not need Google credentials before using it (elastic#21072)
  [Filebeat][New Module] Zoom webhook module (elastic#20414)
  Add support for GMT timezone offset in decode_cef (elastic#20993)
  Filebeat: Fix random error on harvester close (elastic#21048)
  Add ingress controller dashboards (elastic#21052)
  Fix loggers in composable module. (elastic#21047)
  [Ingest Manager] Increase kibana client timeout to 5 minutes (elastic#21037)
  Add changelog. (elastic#21041)
  [Elastic Agent] Add support for EQL based conditions (elastic#20994)
  Disable Kafka metricsets based on Jolokia (elastic#20989)
  Update apm agent (elastic#21031)
  Add container ECS fields in kubernetes metadata (elastic#20984)
  Sanitize event.host in Metricbeat (elastic#21022)
  Update api-keys.asciidoc - API key prerequisites (elastic#21026)
  [Filebeat][suricata] Map x509 for suricata/eve fileset (elastic#20973)
  [Filebeat][santa] Map x509 fields in santa module (elastic#20976)
  [Filebeat][fortinet] Map x509 ecs fields for fortinet fw fileset (elastic#20983)
  Bump zeek kerberos/ssl/x509 ecs version (elastic#21003)
  ...
andrewkroh added a commit that referenced this pull request Sep 14, 2020
@andrewkroh
Add support for GMT timezone offset in decode_cef (#20993) (#21060)
7fb7b6d 
The Java SimpleDataFormat's `zzz` allows for `GMT-07:00` in timestamps
but this wasn't handled in the processor.

(cherry picked from commit 6cfee0c)
andrewkroh added a commit that referenced this pull request Sep 14, 2020
@andrewkroh
Add support for GMT timezone offset in decode_cef (#20993) (#21059)
39ec9dc 
The Java SimpleDataFormat's `zzz` allows for `GMT-07:00` in timestamps
but this wasn't handled in the processor.

(cherry picked from commit 6cfee0c)
v1v added a commit to v1v/beats that referenced this pull request Sep 18, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/ci-pipeli…
4c7e8da 
…ne-2.0

* upstream/master: (44 commits)
  Update users.asciidoc (elastic#20802) (elastic#21108)
  Fix docker provider builder. (elastic#21118)
  [Elastic Agent] Add docker composable dynamic provider. (elastic#20842)
  Add new modules/filesets from rsa2elk for 7.10 (elastic#20820)
  Fix broken links to external websites (elastic#21061)
  [docs] typo in the command line (elastic#20799)
  [Filebeat] add panos type and sub_type (elastic#20912)
  Move the `compute_vm_scalset` to  a light metricset and map the cloud metadata (elastic#21038)
  [Filebeat] Add support for Cloudtrail digest files (elastic#21086)
  Add metrics collection from cost explorer into aws/billing metricset (elastic#20527)
  Add vendoring to Google Cloud Functions again (elastic#21070)
  [Elastic Agent] Add fleet.host.id for sending to endpoint. (elastic#21042)
  Do not need Google credentials before using it (elastic#21072)
  [Filebeat][New Module] Zoom webhook module (elastic#20414)
  Add support for GMT timezone offset in decode_cef (elastic#20993)
  Filebeat: Fix random error on harvester close (elastic#21048)
  Add ingress controller dashboards (elastic#21052)
  Fix loggers in composable module. (elastic#21047)
  [Ingest Manager] Increase kibana client timeout to 5 minutes (elastic#21037)
  Add changelog. (elastic#21041)
  ...
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@andrewkroh
Add support for GMT timezone offset in decode_cef (elastic#20993) (el…
f887f55 
…astic#21060)

The Java SimpleDataFormat's `zzz` allows for `GMT-07:00` in timestamps
but this wasn't handled in the processor.

(cherry picked from commit 8f6472c)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@marc-gr marc-gr marc-gr approved these changes

Assignees
No one assigned
Labels
enhancement Filebeat Filebeat v7.9.2 v7.10.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@andrewkroh @elasticmachine @marc-gr