From aa2f2ddb24f9bd2e49de81e03c71baa496c02d28 Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Tue, 14 Sep 2021 14:34:31 +0200 Subject: [PATCH 1/4] [Filebeat] Removing duplicate modules (aliases) Observability --- filebeat/module/apache2/module.yml | 1 - x-pack/filebeat/filebeat.reference.yml | 57 ------------------ .../module/googlecloud/_meta/config.yml | 55 ------------------ x-pack/filebeat/module/googlecloud/module.yml | 1 - .../modules.d/googlecloud.yml.disabled | 58 ------------------- 5 files changed, 172 deletions(-) delete mode 100644 filebeat/module/apache2/module.yml delete mode 100644 x-pack/filebeat/module/googlecloud/_meta/config.yml delete mode 100644 x-pack/filebeat/module/googlecloud/module.yml delete mode 100644 x-pack/filebeat/modules.d/googlecloud.yml.disabled diff --git a/filebeat/module/apache2/module.yml b/filebeat/module/apache2/module.yml deleted file mode 100644 index 139027d128b8..000000000000 --- a/filebeat/module/apache2/module.yml +++ /dev/null @@ -1 +0,0 @@ -movedTo: apache diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index b30193416cc6..3948d4c15e38 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -1126,63 +1126,6 @@ filebeat.modules: # var.interval: 2h -#----------------------------- Googlecloud Module ----------------------------- -# googlecloud module is deprecated, please use gcp instead -- module: gcp - vpcflow: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing VPC flow logs. Stackdriver must be - # configured to use this topic as a sink for VPC flow logs. - var.topic: gcp-vpc-flowlogs - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-vpc-flowlogs-sub - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json - - firewall: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing firewall logs. Stackdriver must be - # configured to use this topic as a sink for firewall logs. - var.topic: gcp-vpc-firewall - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-firewall-sub - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json - - audit: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing firewall logs. Stackdriver must be - # configured to use this topic as a sink for firewall logs. - var.topic: gcp-vpc-audit - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-audit - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json - #-------------------------------- Gsuite Module -------------------------------- # Gsuite module is deprecated and will be removed in future releases. Please use Google Workspace module instead. - module: gsuite diff --git a/x-pack/filebeat/module/googlecloud/_meta/config.yml b/x-pack/filebeat/module/googlecloud/_meta/config.yml deleted file mode 100644 index 2c535fb4664d..000000000000 --- a/x-pack/filebeat/module/googlecloud/_meta/config.yml +++ /dev/null @@ -1,55 +0,0 @@ -# googlecloud module is deprecated, please use gcp instead -- module: gcp - vpcflow: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing VPC flow logs. Stackdriver must be - # configured to use this topic as a sink for VPC flow logs. - var.topic: gcp-vpc-flowlogs - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-vpc-flowlogs-sub - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json - - firewall: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing firewall logs. Stackdriver must be - # configured to use this topic as a sink for firewall logs. - var.topic: gcp-vpc-firewall - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-firewall-sub - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json - - audit: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing firewall logs. Stackdriver must be - # configured to use this topic as a sink for firewall logs. - var.topic: gcp-vpc-audit - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-audit - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json diff --git a/x-pack/filebeat/module/googlecloud/module.yml b/x-pack/filebeat/module/googlecloud/module.yml deleted file mode 100644 index e5d6de048869..000000000000 --- a/x-pack/filebeat/module/googlecloud/module.yml +++ /dev/null @@ -1 +0,0 @@ -movedTo: gcp diff --git a/x-pack/filebeat/modules.d/googlecloud.yml.disabled b/x-pack/filebeat/modules.d/googlecloud.yml.disabled deleted file mode 100644 index 6f3e6b53e21d..000000000000 --- a/x-pack/filebeat/modules.d/googlecloud.yml.disabled +++ /dev/null @@ -1,58 +0,0 @@ -# Module: googlecloud -# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-googlecloud.html - -# googlecloud module is deprecated, please use gcp instead -- module: gcp - vpcflow: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing VPC flow logs. Stackdriver must be - # configured to use this topic as a sink for VPC flow logs. - var.topic: gcp-vpc-flowlogs - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-vpc-flowlogs-sub - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json - - firewall: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing firewall logs. Stackdriver must be - # configured to use this topic as a sink for firewall logs. - var.topic: gcp-vpc-firewall - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-firewall-sub - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json - - audit: - enabled: true - - # Google Cloud project ID. - var.project_id: my-gcp-project-id - - # Google Pub/Sub topic containing firewall logs. Stackdriver must be - # configured to use this topic as a sink for firewall logs. - var.topic: gcp-vpc-audit - - # Google Pub/Sub subscription for the topic. Filebeat will create this - # subscription if it does not exist. - var.subscription_name: filebeat-gcp-audit - - # Credentials file for the service account with authorization to read from - # the subscription. - var.credentials_file: ${path.config}/gcp-service-account-xyz.json From 57b336136f3455ecaa907a25c23eb0d77aa63d72 Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Tue, 14 Sep 2021 14:36:34 +0200 Subject: [PATCH 2/4] update changelog --- CHANGELOG.next.asciidoc | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 200399b6b4ff..a0cad9ef4ffd 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -85,6 +85,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add option for S3 input to work without SQS notification {issue}18205[18205] {pull}27332[27332] - Fix Crowdstrike ingest pipeline that was creating flattened `process` fields. {issue}27622[27622] {pull}27623[27623] - Rename `log.path` to `log.file.path` in filestream to be consistent with `log` input and ECS. {pull}27761[27761] +- Removes old module aliases for `googlecloud` (moved to gcp) and `apache2` (moved to apache). {pull}27919[27919] *Heartbeat* - Remove long deprecated `watch_poll` functionality. {pull}27166[27166] From 40b0498de1d2e59f46241865739127ba8a8e100b Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Tue, 14 Sep 2021 15:03:59 +0200 Subject: [PATCH 3/4] removing more references and fixing some old wrong documentation --- dev-tools/ecs-migration.yml | 160 +---------- .../autodiscover/builder/hints/logs_test.go | 32 +-- filebeat/docs/fields.asciidoc | 254 ------------------ filebeat/module/apache/_meta/fields.yml | 128 --------- filebeat/module/apache/fields.go | 2 +- libbeat/conditions/matcher_test.go | 6 +- .../module/gcp/billing/_meta/docs.asciidoc | 2 +- .../module/gcp/metrics/_meta/docs.asciidoc | 8 +- 8 files changed, 30 insertions(+), 562 deletions(-) diff --git a/dev-tools/ecs-migration.yml b/dev-tools/ecs-migration.yml index 6d8cea78a215..fba03edb34e1 100644 --- a/dev-tools/ecs-migration.yml +++ b/dev-tools/ecs-migration.yml @@ -54,7 +54,7 @@ alias6: true alias: true -- from: docker.container.labels # TODO: How to map these? +- from: docker.container.labels # TODO: How to map these? to: container.labels alias6: false alias: true @@ -115,8 +115,8 @@ - from: source to: - - log.file.path - - log.source.address + - log.file.path + - log.source.address alias: false beat: filebeat @@ -428,7 +428,7 @@ beat: filebeat - from: suricata.eve.timestamp - to: '@timestamp' + to: "@timestamp" alias: true beat: filebeat @@ -476,7 +476,7 @@ beat: filebeat - from: system.auth.timestamp - to: '@timestamp' + to: "@timestamp" alias: true beat: filebeat @@ -560,155 +560,6 @@ alias: true beat: filebeat -## Apache module - -- from: apache2.access.remote_ip - to: source.address - alias: true - beat: filebeat - -- from: apache2.access.user_name - to: user.name - alias: true - beat: filebeat - -- from: apache2.access.method - to: http.request.method - alias: true - beat: filebeat - -- from: apache2.access.url - to: url.original - alias: true - beat: filebeat - -- from: apache2.access.http_version - to: http.version - alias: true - beat: filebeat - -- from: apache2.access.response_code - to: http.response.status_code - alias: true - beat: filebeat - -- from: apache2.access.referrer - to: http.request.referrer - alias: true - beat: filebeat - -- from: apache2.access.agent - to: user_agent.original - alias: true - beat: filebeat - -- from: apache2.access.body_sent.bytes - to: http.response.body.bytes - alias: true - beat: filebeat - -- from: apache2.access.geoip.continent_name - to: source.geo.continent_name - alias: true - beat: filebeat - -- from: apache2.access.geoip.country_iso_code - to: source.geo.country_iso_code - alias: true - beat: filebeat - -- from: apache2.access.geoip.location - to: source.geo.location - alias: true - beat: filebeat - -- from: apache2.access.geoip.region_name - to: source.geo.region_name - alias: true - beat: filebeat - -- from: apache2.access.geoip.city_name - to: source.geo.city_name - alias: true - beat: filebeat - -- from: apache2.access.geoip.region_iso_code - to: source.geo.region_iso_code - alias: true - beat: filebeat - -- from: apache2.access.user_agent.original - to: user_agent.original - alias: true - beat: filebeat -- from: apache2.access.user_agent.device - to: user_agent.device.name - alias: true - beat: filebeat -- from: apache2.access.user_agent.name - to: user_agent.name - alias: true - beat: filebeat -- from: apache2.access.user_agent.os - to: user_agent.os.full_name - alias: true - beat: filebeat -- from: apache2.access.user_agent.os_name - to: user_agent.os.name - alias: true - beat: filebeat - -- from: apache2.access.user_agent.major - to: user_agent.version - alias: false - beat: filebeat -- from: apache2.access.user_agent.minor - to: user_agent.version - alias: false - beat: filebeat -- from: apache2.access.user_agent.patch - to: user_agent.version - alias: false - beat: filebeat -- from: apache2.access.user_agent.os_major - to: user_agent.os.version - alias: false - beat: filebeat -- from: apache2.access.user_agent.os_minor - to: user_agent.os.version - alias: false - beat: filebeat -- from: apache2.access.user_agent.os_patch - to: user_agent.os.version - alias: false - beat: filebeat - -### Error fileset -- from: apache2.error.message - to: message - alias: true - beat: filebeat - -- from: apache2.error.level - to: log.level - alias: true - beat: filebeat - -- from: apache2.error.client - to: source.address - alias: true - beat: filebeat - -- from: apache2.error.pid - to: process.pid - alias: true - beat: filebeat - -- from: apache2.error.tid - to: process.thread.id - alias: true - beat: filebeat - ## Elasticsearch module - from: elasticsearch.audit.origin_address @@ -1748,7 +1599,6 @@ alias: true beat: metricbeat - ### Redis - from: php_fpm.status.pid diff --git a/filebeat/autodiscover/builder/hints/logs_test.go b/filebeat/autodiscover/builder/hints/logs_test.go index e00ec39920eb..ae1ca2083130 100644 --- a/filebeat/autodiscover/builder/hints/logs_test.go +++ b/filebeat/autodiscover/builder/hints/logs_test.go @@ -405,14 +405,14 @@ func TestGenerateHints(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", }, }, }, len: 1, result: []common.MapStr{ { - "module": "apache2", + "module": "apache", "error": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ @@ -455,7 +455,7 @@ func TestGenerateHints(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", "fileset": "access", }, }, @@ -463,7 +463,7 @@ func TestGenerateHints(t *testing.T) { len: 1, result: []common.MapStr{ { - "module": "apache2", + "module": "apache", "access": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ @@ -506,7 +506,7 @@ func TestGenerateHints(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", "fileset.stdout": "access", "fileset.stderr": "error", }, @@ -515,7 +515,7 @@ func TestGenerateHints(t *testing.T) { len: 1, result: []common.MapStr{ { - "module": "apache2", + "module": "apache", "access": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ @@ -558,14 +558,14 @@ func TestGenerateHints(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", }, }, }, len: 1, result: []common.MapStr{ { - "module": "apache2", + "module": "apache", "error": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ @@ -606,7 +606,7 @@ func TestGenerateHints(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", "fileset": "access", }, }, @@ -614,7 +614,7 @@ func TestGenerateHints(t *testing.T) { len: 1, result: []common.MapStr{ { - "module": "apache2", + "module": "apache", "access": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ @@ -655,7 +655,7 @@ func TestGenerateHints(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", "fileset.stdout": "access", "fileset.stderr": "error", }, @@ -664,7 +664,7 @@ func TestGenerateHints(t *testing.T) { len: 1, result: []common.MapStr{ { - "module": "apache2", + "module": "apache", "access": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ @@ -826,14 +826,14 @@ func TestGenerateHintsWithPaths(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", }, }, }, len: 1, path: "/var/log/pods/${data.kubernetes.pod.uid}/${data.kubernetes.container.name}/*.log", result: common.MapStr{ - "module": "apache2", + "module": "apache", "error": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ @@ -878,7 +878,7 @@ func TestGenerateHintsWithPaths(t *testing.T) { }, "hints": common.MapStr{ "logs": common.MapStr{ - "module": "apache2", + "module": "apache", "fileset": "access", }, }, @@ -886,7 +886,7 @@ func TestGenerateHintsWithPaths(t *testing.T) { len: 1, path: "/var/log/pods/${data.kubernetes.pod.uid}/${data.kubernetes.container.name}/*.log", result: common.MapStr{ - "module": "apache2", + "module": "apache", "access": map[string]interface{}{ "enabled": true, "input": map[string]interface{}{ diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 6e40ec0107fd..9aa6dfabef9c 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -166,260 +166,6 @@ Apache Module -[float] -=== apache2 - -Aliases for backward compatibility with old apache2 fields - - - - -*`apache2.access.remote_ip`*:: -+ --- -type: alias - -alias to: source.address - --- - -*`apache2.access.ssl.protocol`*:: -+ --- -type: alias - -alias to: apache.access.ssl.protocol - --- - -*`apache2.access.ssl.cipher`*:: -+ --- -type: alias - -alias to: apache.access.ssl.cipher - --- - -*`apache2.access.body_sent.bytes`*:: -+ --- -type: alias - -alias to: http.response.body.bytes - --- - -*`apache2.access.user_name`*:: -+ --- -type: alias - -alias to: user.name - --- - -*`apache2.access.method`*:: -+ --- -type: alias - -alias to: http.request.method - --- - -*`apache2.access.url`*:: -+ --- -type: alias - -alias to: url.original - --- - -*`apache2.access.http_version`*:: -+ --- -type: alias - -alias to: http.version - --- - -*`apache2.access.response_code`*:: -+ --- -type: alias - -alias to: http.response.status_code - --- - -*`apache2.access.referrer`*:: -+ --- -type: alias - -alias to: http.request.referrer - --- - -*`apache2.access.agent`*:: -+ --- -type: alias - -alias to: user_agent.original - --- - - -*`apache2.access.user_agent.device`*:: -+ --- -type: alias - -alias to: user_agent.device.name - --- - -*`apache2.access.user_agent.name`*:: -+ --- -type: alias - -alias to: user_agent.name - --- - -*`apache2.access.user_agent.os`*:: -+ --- -type: alias - -alias to: user_agent.os.full_name - --- - -*`apache2.access.user_agent.os_name`*:: -+ --- -type: alias - -alias to: user_agent.os.name - --- - -*`apache2.access.user_agent.original`*:: -+ --- -type: alias - -alias to: user_agent.original - --- - - -*`apache2.access.geoip.continent_name`*:: -+ --- -type: alias - -alias to: source.geo.continent_name - --- - -*`apache2.access.geoip.country_iso_code`*:: -+ --- -type: alias - -alias to: source.geo.country_iso_code - --- - -*`apache2.access.geoip.location`*:: -+ --- -type: alias - -alias to: source.geo.location - --- - -*`apache2.access.geoip.region_name`*:: -+ --- -type: alias - -alias to: source.geo.region_name - --- - -*`apache2.access.geoip.city_name`*:: -+ --- -type: alias - -alias to: source.geo.city_name - --- - -*`apache2.access.geoip.region_iso_code`*:: -+ --- -type: alias - -alias to: source.geo.region_iso_code - --- - - -*`apache2.error.level`*:: -+ --- -type: alias - -alias to: log.level - --- - -*`apache2.error.message`*:: -+ --- -type: alias - -alias to: message - --- - -*`apache2.error.pid`*:: -+ --- -type: alias - -alias to: process.pid - --- - -*`apache2.error.tid`*:: -+ --- -type: alias - -alias to: process.thread.id - --- - -*`apache2.error.module`*:: -+ --- -type: alias - -alias to: apache.error.module - --- - [float] === apache diff --git a/filebeat/module/apache/_meta/fields.yml b/filebeat/module/apache/_meta/fields.yml index cbd235a7268c..ead9903ad9d3 100644 --- a/filebeat/module/apache/_meta/fields.yml +++ b/filebeat/module/apache/_meta/fields.yml @@ -4,134 +4,6 @@ Apache Module short_config: true fields: - - name: apache2 - type: group - description: > - Aliases for backward compatibility with old apache2 fields - fields: - - name: access - type: group - fields: - - name: remote_ip - type: alias - path: source.address - migration: true - - name: ssl.protocol - type: alias - path: apache.access.ssl.protocol - migration: true - - name: ssl.cipher - type: alias - path: apache.access.ssl.cipher - migration: true - - name: body_sent.bytes - type: alias - path: http.response.body.bytes - migration: true - - name: user_name - type: alias - path: user.name - migration: true - - name: method - type: alias - path: http.request.method - migration: true - - name: url - type: alias - path: url.original - migration: true - - name: http_version - type: alias - path: http.version - migration: true - - name: response_code - type: alias - path: http.response.status_code - migration: true - - name: referrer - type: alias - path: http.request.referrer - migration: true - - name: agent - type: alias - path: user_agent.original - migration: true - - - name: user_agent - type: group - fields: - - name: device - type: alias - path: user_agent.device.name - migration: true - - name: name - type: alias - path: user_agent.name - migration: true - - name: os - type: alias - path: user_agent.os.full_name - migration: true - - name: os_name - type: alias - path: user_agent.os.name - migration: true - - name: original - type: alias - path: user_agent.original - migration: true - - name: geoip - type: group - fields: - - name: continent_name - type: alias - path: source.geo.continent_name - migration: true - - name: country_iso_code - type: alias - path: source.geo.country_iso_code - migration: true - - name: location - type: alias - path: source.geo.location - migration: true - - name: region_name - type: alias - path: source.geo.region_name - migration: true - - name: city_name - type: alias - path: source.geo.city_name - migration: true - - name: region_iso_code - type: alias - path: source.geo.region_iso_code - migration: true - - name: error - type: group - fields: - - name: level - type: alias - path: log.level - migration: true - - name: message - type: alias - path: message - migration: true - - name: pid - type: alias - path: process.pid - migration: true - - name: tid - type: alias - path: process.thread.id - migration: true - - name: module - type: alias - path: apache.error.module - migration: true - - - name: apache type: group description: > diff --git a/filebeat/module/apache/fields.go b/filebeat/module/apache/fields.go index 1e0b1608ebbc..b24297a9888d 100644 --- a/filebeat/module/apache/fields.go +++ b/filebeat/module/apache/fields.go @@ -32,5 +32,5 @@ func init() { // AssetApache returns asset data. // This is the base64 encoded zlib format compressed contents of module/apache. func AssetApache() string { - return "eJysl7+O4zgMxvs8BTH9qLgyxQGHAw5X3AELzPSGIjO2MIropegM/PYL/5tNMrIjOXEVyOH3/SjSgvgKH9jtQTfa1LgDECsO9/Dy17DwsgMoMRi2jVjye/hzBwAwvoT/qWxdHxRqYikM+aOt9iDc9otHi64M+yHgFbw+4Wzzx7AGIF2De6iY2mZaiXgNfs7qgAGOxHDQ5uNTcwmGTo0We7DOSgefVmogV84Wk/0kcclyxWMMhvC1HEOKhV9KMJ5IsLDN1dtZSffkN28aLfUeArVsUOmy5GuE/jnZivW4C9NufjcOwamGSciQy/Qe90iN2asVoVQOY5sa+WGKqEwKw4HKrgjoRR06wVu7eyC1SKMYQ0M+oOq1ojIpIG1ALvqfmQh9nIrEpXieUGoqt+X8s8UgKqqQlC7ntl7LThHbynq9pdl67OKMHCz5LRnHQ1Oc5/4oDJW51b1usCBa2hDTSeM4InP2x3ZV7wWNFHtdoZcNzV0MgamlX/62lv1vD21YOLgvJUs8W3NbhfWUommNOrEPOJbdEs1CeCbLgxAUM8lEoKCOrXOxgzAPZUkhn+dRlHjfbmFZVkr5/iqkhavGlv435MV69PLIRk83mQpJ3dVL3W9DrRfuChsodlBuQrurmArnyAx/exxqRSkVhrGy5J9Uv3Wx5OJZ6Z7VUCtSmTv0vFa6L7iENiMhM/FDY4fDM+bevRxVKhaXdskMQVe5F594VIpfY3NvtA3TMEh8j0zxk81+UjPqUm1yPc0TdI7xNDcNPaSiCt+uU5EhPHsGH2f+sSfVc+bqBav++Zu8aOvDZDGM/lLjjPHv+/sPeEM+I09mfXd/ccXYIGd2/sDuk/i2pCu8/fP29h/MqjBNGr+JtgzPmzFGzcFEbTx9Vlz+mWrCdLosyqCbVYeV/t+U+nuNk2ZfiLI11lcDoaOqwnI+j9TuVwAAAP//QYrRgg==" + return "eJysksFq6zAQRff+ikv28Qdo8eBRKF20UEj2xUgTWUTWiJGckr8vcuTUadNAaWY5su455mqNPR0Vutjpnhogu+xJYfV/WqwawFDS4mJ2HBT+NQBwOsQLm9GXS6lnyW+aw85ZhSxjWe4ceZPUdGGN0A20wJTJx0gKVniMdXMFtcCdAtu6XsZfILSmlM7ra5gbqDIPHHLnQqoI7FiQe5o1nrbbV2xIDiQVBs/27HXNbemXkm+jcGbN/uKD2XRPx3cW8+Xshm+ZzeYZcyoOJMlx+DT6UUS72JPcV+OUOUHab+2QCMtfynmsnQgPy1Km3F/1MMyP906/vu2pZpYizKhdsJOhZ2vJYKCUOktt8xEAAP//tzvrEQ==" } diff --git a/libbeat/conditions/matcher_test.go b/libbeat/conditions/matcher_test.go index 0bdf3ea6a684..0436930523b9 100644 --- a/libbeat/conditions/matcher_test.go +++ b/libbeat/conditions/matcher_test.go @@ -78,19 +78,19 @@ func TestRegexpCondition(t *testing.T) { configs := []Config{ { Regexp: &Fields{fields: map[string]interface{}{ - "source": "apache2/error.*", + "source": "apache/error.*", }}, }, { Regexp: &Fields{fields: map[string]interface{}{ - "source": "apache2/access.*", + "source": "apache/access.*", }}, }, { Regexp: &Fields{fields: map[string]interface{}{ - "source": "apache2/error.*", + "source": "apache/error.*", "message": "[client 1.2.3.4]", }}, }, diff --git a/x-pack/metricbeat/module/gcp/billing/_meta/docs.asciidoc b/x-pack/metricbeat/module/gcp/billing/_meta/docs.asciidoc index ccf26a176006..d66330f927f6 100644 --- a/x-pack/metricbeat/module/gcp/billing/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/gcp/billing/_meta/docs.asciidoc @@ -27,7 +27,7 @@ tax, adjustment, or rounding error. Default to `regular`. === Configuration example [source,yaml] ---- -- module: googlecloud +- module: gcp metricsets: - billing period: 24h diff --git a/x-pack/metricbeat/module/gcp/metrics/_meta/docs.asciidoc b/x-pack/metricbeat/module/gcp/metrics/_meta/docs.asciidoc index 157e336e08b3..45b5be522a05 100644 --- a/x-pack/metricbeat/module/gcp/metrics/_meta/docs.asciidoc +++ b/x-pack/metricbeat/module/gcp/metrics/_meta/docs.asciidoc @@ -58,7 +58,7 @@ given aggregation aligner applied for each metric type. + [source,yaml] ---- -- module: googlecloud +- module: gcp metricsets: - metrics zone: "europe-west1-c" @@ -91,7 +91,7 @@ ignored. + [source,yaml] ---- -- module: googlecloud +- module: gcp metricsets: - metrics zone: "europe-west1-c" @@ -125,7 +125,7 @@ every minute with no aggregation. The metric types in `compute` service with + [source,yaml] ---- -- module: googlecloud +- module: gcp metricsets: - metrics zone: "europe-west1-c" @@ -149,7 +149,7 @@ metric prefix, as for GKE metrics the required prefix is `kubernetes.io/` + [source,yaml] ---- -- module: googlecloud +- module: gcp metricsets: - metrics zone: "europe-west1-c" From 9f6c8c7541340a778c0cc82df82d11ae1860051b Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Wed, 15 Sep 2021 09:20:53 +0200 Subject: [PATCH 4/4] reverting regex test --- libbeat/conditions/matcher_test.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libbeat/conditions/matcher_test.go b/libbeat/conditions/matcher_test.go index 0436930523b9..0bdf3ea6a684 100644 --- a/libbeat/conditions/matcher_test.go +++ b/libbeat/conditions/matcher_test.go @@ -78,19 +78,19 @@ func TestRegexpCondition(t *testing.T) { configs := []Config{ { Regexp: &Fields{fields: map[string]interface{}{ - "source": "apache/error.*", + "source": "apache2/error.*", }}, }, { Regexp: &Fields{fields: map[string]interface{}{ - "source": "apache/access.*", + "source": "apache2/access.*", }}, }, { Regexp: &Fields{fields: map[string]interface{}{ - "source": "apache/error.*", + "source": "apache2/error.*", "message": "[client 1.2.3.4]", }}, },