[ecs] Update fields.ecs.yml to 1.12 #27770

marc-gr · 2021-09-07T11:01:20Z

What does this PR do?

fields.ecs.yml to ECS 1.12.0-dev
bump ecs.version in configs for modules that don't require changes.

Why is it important?

keep up to date with ECS changes
allows modules to use new ECS fields

Checklist

My code follows the style guidelines of this project
~~- [ ] I have commented my code, particularly in hard-to-understand areas~~
~~- [ ] I have made corresponding changes to the documentation~~
~~- [ ] I have made corresponding change to the default configuration files~~
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

cd filebeat && mage pythonIntegTest
cd x-pack/filebeat && mage pythonIntegTest

Closes #27835

elasticmachine · 2021-09-07T11:01:22Z

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine · 2021-09-07T15:05:35Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2021-09-30T09:58:37.850+0000
Duration: 223 min 50 sec
Commit: 0dccfea

Test stats 🧪

Test	Results
Failed	0
Passed	54147
Skipped	5328
Total	59475

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.

mergify · 2021-09-16T10:41:31Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b ecs-1.12 upstream/ecs-1.12
git merge upstream/master
git push upstream ecs-1.12

andrewkroh

This changes message to use match_only_text which was introduced in 7.14. I think libbeat should fall-back to text if that type is not available. We added something similar for wildcard at

beats/libbeat/template/processor.go

Lines 90 to 96 in 7a49ca1

    
           case "wildcard": 
        
           	noWildcards := p.EsVersion.LessThan(minVersionWildcard) 
        
           	if !p.ElasticLicensed || noWildcards { 
        
           		indexMapping = p.keyword(&field) 
        
           	} else { 
        
           		indexMapping = p.wildcard(&field) 
        
           	}

.

mergify · 2021-09-28T15:10:46Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b ecs-1.12 upstream/ecs-1.12
git merge upstream/master
git push upstream ecs-1.12

leehinman

LGTM

CHANGELOG.next.asciidoc

mdelapenya

From E2E stand point, I'd say this PR is OK, as the errors we are seeing in the build history are considered flaky

* Update fields.ecs.yml to 1.12 * Fallback to text when match_only_text is unavailable * Add changelog entry * Amend changelog entry * Remove duplicated service.address field from metricbeat (cherry picked from commit cca59ba) # Conflicts: # auditbeat/include/fields.go # filebeat/docs/fields.asciidoc # filebeat/include/fields.go # go.mod # heartbeat/include/fields.go # journalbeat/include/fields.go # metricbeat/docs/fields.asciidoc # metricbeat/include/fields/fields.go # packetbeat/include/fields.go # winlogbeat/include/fields.go # x-pack/functionbeat/include/fields.go # x-pack/heartbeat/include/fields.go # x-pack/osquerybeat/include/fields.go

* Update fields.ecs.yml to 1.12 * Fallback to text when match_only_text is unavailable * Add changelog entry * Amend changelog entry * Remove duplicated service.address field from metricbeat (cherry picked from commit cca59ba)

* Update fields.ecs.yml to 1.12 * Fallback to text when match_only_text is unavailable * Add changelog entry * Amend changelog entry * Remove duplicated service.address field from metricbeat (cherry picked from commit cca59ba) Co-authored-by: Marc Guasch <[email protected]>

* Update fields.ecs.yml to 1.12 * Fallback to text when match_only_text is unavailable * Add changelog entry * Amend changelog entry * Remove duplicated service.address field from metricbeat

marc-gr added enhancement in progress Pull request is currently in progress. ecs Team:Security-External Integrations backport-v7.16.0 Automated backport with mergify labels Sep 7, 2021

marc-gr requested a review from a team as a code owner September 7, 2021 11:01

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Sep 7, 2021

andrewkroh requested changes Sep 20, 2021

View reviewed changes

marc-gr force-pushed the ecs-1.12 branch 2 times, most recently from 7f10576 to be2a882 Compare September 27, 2021 11:35

marc-gr force-pushed the ecs-1.12 branch 3 times, most recently from f85962b to e31acb9 Compare September 29, 2021 13:04

marc-gr removed the in progress Pull request is currently in progress. label Sep 29, 2021

marc-gr requested a review from andrewkroh September 29, 2021 13:07

leehinman approved these changes Sep 29, 2021

View reviewed changes

andrewkroh reviewed Sep 29, 2021

View reviewed changes

CHANGELOG.next.asciidoc Outdated Show resolved Hide resolved

andrewkroh approved these changes Sep 29, 2021

View reviewed changes

marc-gr added 4 commits September 30, 2021 09:10

Update fields.ecs.yml to 1.12

09ffe38

Fallback to text when match_only_text is unavailable

fe8760b

Add changelog entry

ef8dacd

Amend changelog entry

066ee78

marc-gr force-pushed the ecs-1.12 branch from 6a4c8a4 to 066ee78 Compare September 30, 2021 07:10

Remove duplicated service.address field from metricbeat

0dccfea

marc-gr force-pushed the ecs-1.12 branch from f78f195 to 0dccfea Compare September 30, 2021 09:58

mdelapenya approved these changes Oct 1, 2021

View reviewed changes

marc-gr merged commit cca59ba into elastic:master Oct 1, 2021

marc-gr deleted the ecs-1.12 branch October 1, 2021 13:34

mergify bot mentioned this pull request Oct 1, 2021

[7.x](backport #27770) [ecs] Update fields.ecs.yml to 1.12 #28216

Merged

adriansr mentioned this pull request Dec 29, 2021

message field missing from index template's default_field #29633

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ecs] Update fields.ecs.yml to 1.12 #27770

[ecs] Update fields.ecs.yml to 1.12 #27770

marc-gr commented Sep 7, 2021 •

edited

Loading

elasticmachine commented Sep 7, 2021

elasticmachine commented Sep 7, 2021 •

edited by jenkins-beats-ci bot

Loading

Build stats

Test stats 🧪

mergify bot commented Sep 16, 2021

andrewkroh left a comment

mergify bot commented Sep 28, 2021

leehinman left a comment

mdelapenya left a comment

	case "wildcard":
	noWildcards := p.EsVersion.LessThan(minVersionWildcard)
	if !p.ElasticLicensed \|\| noWildcards {
	indexMapping = p.keyword(&field)
	} else {
	indexMapping = p.wildcard(&field)
	}

[ecs] Update fields.ecs.yml to 1.12 #27770

[ecs] Update fields.ecs.yml to 1.12 #27770

Conversation

marc-gr commented Sep 7, 2021 • edited Loading

What does this PR do?

Why is it important?

Checklist

How to test this PR locally

elasticmachine commented Sep 7, 2021

elasticmachine commented Sep 7, 2021 • edited by jenkins-beats-ci bot Loading

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

mergify bot commented Sep 16, 2021

andrewkroh left a comment

Choose a reason for hiding this comment

mergify bot commented Sep 28, 2021

leehinman left a comment

Choose a reason for hiding this comment

mdelapenya left a comment

Choose a reason for hiding this comment

marc-gr commented Sep 7, 2021 •

edited

Loading

elasticmachine commented Sep 7, 2021 •

edited by jenkins-beats-ci bot

Loading