Add parsers examples to filestream reference configuration
#30529
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
botelastic
bot
added
the
needs_team
|
Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane) |
botelastic
bot
removed
the
needs_team
|
This pull request does not have a backport label. Could you fix it @kvch? 🙏
NOTE: |
mergify
bot
added
the
backport-skip
kvch
added
backport-7.17
mergify
bot
removed
the
backport-skip
rdner
reviewed
Feb 22, 2022
rdner
reviewed
Feb 22, 2022
rdner
reviewed
Feb 22, 2022
rdner
reviewed
Feb 22, 2022
rdner
reviewed
Feb 22, 2022
rdner
reviewed
Feb 22, 2022
rdner
reviewed
Feb 22, 2022
rdner
reviewed
Feb 22, 2022
Co-authored-by: Denis Rechkunov <[email protected]>
Co-authored-by: Denis Rechkunov <[email protected]>
Co-authored-by: Denis Rechkunov <[email protected]>
Co-authored-by: Denis Rechkunov <[email protected]>
Co-authored-by: Denis Rechkunov <[email protected]>
Co-authored-by: Denis Rechkunov <[email protected]>
Co-authored-by: Denis Rechkunov <[email protected]>
Co-authored-by: Denis Rechkunov <[email protected]>
rdner
approved these changes
Feb 22, 2022
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
mergify bot
pushed a commit
that referenced
this pull request
Feb 22, 2022
(cherry picked from commit a159cce)
mergify bot
pushed a commit
that referenced
this pull request
Feb 22, 2022
(cherry picked from commit a159cce)
mergify bot
pushed a commit
that referenced
this pull request
Feb 22, 2022
(cherry picked from commit a159cce)
kvch
added a commit
that referenced
this pull request
Feb 22, 2022
… (#30535) (cherry picked from commit a159cce) Co-authored-by: Noémi Ványi <[email protected]>
kvch
added a commit
that referenced
this pull request
Feb 22, 2022
… (#30536) (cherry picked from commit a159cce) Co-authored-by: Noémi Ványi <[email protected]>
kvch
added a commit
that referenced
this pull request
Feb 22, 2022
… (#30537) (cherry picked from commit a159cce) Co-authored-by: Noémi Ványi <[email protected]>
v1v
added a commit
to v1v/beats
that referenced
this pull request
Feb 22, 2022
…ckaging-docker * upstream/main: (26 commits) Update docker/distribution to 2.8.0 (elastic#30462) Add `parsers` examples to `filestream` reference configuration (elastic#30529) extend documentation about setting orchestrator.cluster fields (elastic#30518) Forward-port 8.0.1 changelog to main (elastic#30522) Switch skip to use `CI` (elastic#30512) packetbeat/beater: don't attempt to install npcap when already installed (elastic#30509) Fix Docker module: rename fields on dashboards (elastic#30500) fix typos and improve sentences (elastic#30432) Add drop and explicit tests to avoid duplicate ingest of elasticsearch logs (elastic#30440) {,x-pack/}auditbeat: replace uses of github.com/pkg/errors with stdlib equivalents (elastic#30321) Spelling fix (elastic#30439) packetbeat/beater: make sure Npcap installation runs before interfaces are needed in all cases (elastic#30438) Add BC about Homebrew no longer being available in 8.0 (elastic#30419) Install gawk as a replacement for mawk in Docker containers. (elastic#30452) Clean up python-related system tests (elastic#30415) Fix TestNewModuleRegistry flakiness (elastic#30453) [Filebeat] [auditd]: Support EXECVE events with truncated argument list (elastic#30382) Set `log.offset` to the start of the reported line in filestream (elastic#30445) clarify SelectedPackageTypes meaning and improve its usage (elastic#30142) [elasticsearch module] serialize shards properties (elastic#30408) ...
v1v
added a commit
to v1v/beats
that referenced
this pull request
Feb 22, 2022
…nd-k8s-env * upstream/main: Update docker/distribution to 2.8.0 (elastic#30462) Add `parsers` examples to `filestream` reference configuration (elastic#30529) extend documentation about setting orchestrator.cluster fields (elastic#30518) Forward-port 8.0.1 changelog to main (elastic#30522) Switch skip to use `CI` (elastic#30512) packetbeat/beater: don't attempt to install npcap when already installed (elastic#30509) Fix Docker module: rename fields on dashboards (elastic#30500)
v1v
added a commit
that referenced
this pull request
Mar 2, 2022
…-29710 * '8.1' of github.com:elastic/beats: (51 commits) refactor pushDockerImages (#30414) (#30624) ci: add windows-2022 in the extended meta-stage (#30528) (#30630) Curate k8s testing versions to only keep the actively maintained (#30619) (#30625) [8.1](backport #30355) Add Beats upgrade docs for 8.0 (#30612) Remove references to gcp from the Functionbeat docs (#30579) (#30609) x-pack/auditbeat/module/system/socket: defend against exec with zero arguments (#30586) (#30597) [MySQL Enterprise] Adding default paths values to manifest.yml (#30598) (#30604) metricbeat - fix elasticsearch and kibana integration tests failures in 8.0 (#30566) (#30594) Install gawk as a replacement for mawk in Docker containers. (#30452) (#30465) [Filebeat] Remove RecordedFuture dataset from Threat Intel module (#30564) (#30568) Adjust the documentation of `backoff` options in filestream input (#30552) (#30557) packetbeat/beater: help the GC clean up the Npcap installer if it's not used (#30513) (#30546) Osquerybeat: Add install verification for osquerybeat (#30388) (#30404) Update docker/distribution to 2.8.0 (#30462) (#30540) Add `parsers` examples to `filestream` reference configuration (#30529) (#30537) [8.1](backport #30068) ZooKeeper module: Adapt to ZooKeeper 3.6+ `mntr` response fields' changes. (#30360) [8.1](backport #30512) Switch skip to use `CI` (#30525) Forward-port 8.0.1 changelog to 8.1 (#30517) packetbeat/beater: don't attempt to install npcap when already installed (#30509) (#30511) Add drop and explicit tests to avoid duplicate ingest of elasticsearch logs (#30440) (#30488) ...
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR adds the missing
parserssections to the reference configuration of Filebeat.Why is it important?
One recurring issue in filestream is users misconfiguring parsers. The documentation is somewhat detailed on the topic. However,
parserswere missing from the reference configuration. I am adding moreparserexamples to ease adoption of filestream and decrease user frustration/confusion.Checklist
- [ ] My code follows the style guidelines of this project- [ ] I have commented my code, particularly in hard-to-understand areas- [ ] I have made corresponding changes to the documentation- [ ] I have added tests that prove my fix is effective or that my feature works- [ ] I have added an entry inCHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.