diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 5092128805b..6094bfd1f42 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -157,8 +157,10 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff] - Improve httpjson documentation for split processor. {pull}33473[33473] - Added separation of transform context object inside httpjson. Introduced new clause `.parent_last_response.*` {pull}33499[33499] - Cloud Foundry input uses server-side filtering when retrieving logs. {pull}33456[33456] +- Disable "event normalization" processing for the aws-s3 input to reduce allocations. {pull}33673[33673] - Add Common Expression Language input. {pull}31233[31233] + *Auditbeat* diff --git a/x-pack/filebeat/input/awss3/input.go b/x-pack/filebeat/input/awss3/input.go index e93ff421693..b76df41deea 100644 --- a/x-pack/filebeat/input/awss3/input.go +++ b/x-pack/filebeat/input/awss3/input.go @@ -112,6 +112,11 @@ func (in *s3Input) Run(inputContext v2.Context, pipeline beat.Pipeline) error { client, err := pipeline.ConnectWith(beat.ClientConfig{ CloseRef: inputContext.Cancelation, ACKHandler: awscommon.NewEventACKHandler(), + Processing: beat.ProcessingConfig{ + // This input only produces events with basic types so normalization + // is not required. + EventNormalization: boolPtr(false), + }, }) if err != nil { return fmt.Errorf("failed to create pipeline client: %w", err) @@ -368,3 +373,6 @@ func getProviderFromDomain(endpoint string, ProviderOverride string) string { } return "unknown" } + +// boolPtr returns a pointer to b. +func boolPtr(b bool) *bool { return &b }