Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Logs UI] Fix some filebeat ECS message formats #31120

Merged

Conversation

weltenwort
Copy link
Member

@weltenwort weltenwort commented Feb 14, 2019

Summary

This fixes the message reconstruction for the ECS formats of several filebeat modules by adding appropriate specific and generic rules. Fixed modules include:

  • auditd
  • haproxy
  • apache
  • nginx
  • iis
  • traefik
  • generic web access logs
  • logstash
  • mysql

In addition the generic log message fallbacks now try to make use of the standardized event.dataset and log.severity fields. The new log.original field has also been added as a fallback.

The formats were developed to work with the filebeat 7.0.0 test sample files.

Checklist

For maintainers

@weltenwort weltenwort added v7.0.0 [zube]: In Progress Feature:Logs UI Logs UI feature v6.7.0 Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services labels Feb 14, 2019
@weltenwort weltenwort self-assigned this Feb 14, 2019
@elasticmachine
Copy link
Contributor

Pinging @elastic/infrastructure-ui

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

@weltenwort weltenwort force-pushed the infra-ui-fix-ecs-filebeat-messages branch from 123c717 to 452eac2 Compare February 20, 2019 10:22
@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Copy link
Member

@simianhacker simianhacker left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM... I gave it a read through and nothing stands out to me. I also ran it in my browser with the data I have it seems to work. I didn't physically test every input listed but I'm pretty confident since the tests cover those.

@weltenwort weltenwort merged commit 3d7a6a1 into elastic:master Feb 21, 2019
weltenwort added a commit to weltenwort/kibana that referenced this pull request Feb 21, 2019
weltenwort added a commit to weltenwort/kibana that referenced this pull request Feb 21, 2019
weltenwort added a commit that referenced this pull request Feb 21, 2019
Backports the following commits to 6.7:
 - [Logs UI] Fix some filebeat ECS message formats (#31120)
weltenwort added a commit to weltenwort/kibana that referenced this pull request Feb 22, 2019
weltenwort added a commit that referenced this pull request Feb 22, 2019
Backports the following commits to 7.x:
 - [Logs UI] Fix some filebeat ECS message formats  (#31120)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Logs UI Logs UI feature release_note:fix review Team:Infra Monitoring UI - DEPRECATED DEPRECATED - Label for the Infra Monitoring UI team. Use Team:obs-ux-infra_services v6.7.0 v7.0.0 v7.2.0 v8.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants