From 1d38cc9f117658ba12559d663185bcd6f6b2cb88 Mon Sep 17 00:00:00 2001 From: Mathieu Martin Date: Fri, 29 Mar 2019 07:23:37 -0400 Subject: [PATCH] Fix field alias for nginx.access.remote_ip (#11512) - It was missing in the breaking changes doc (generated from ecs-migration.yml) - The actual field alias was incorrectly pointing to source.ip, this has been adjusted to source.address - Re-generating the documentation file also updated the breaking changes to include a change introduced in #11334 This should be backported to 7.0. Closes #11510 (cherry picked from commit 692ef9e8b2fa07aed78eb57fb2b1de6b39cce743) --- dev-tools/ecs-migration.yml | 5 +++++ filebeat/docs/fields.asciidoc | 2 +- filebeat/module/nginx/access/_meta/fields.yml | 2 +- filebeat/module/nginx/fields.go | 2 +- libbeat/docs/field-name-changes.asciidoc | 2 +- 5 files changed, 9 insertions(+), 4 deletions(-) diff --git a/dev-tools/ecs-migration.yml b/dev-tools/ecs-migration.yml index 2b55db8d50d1..095b26212a62 100644 --- a/dev-tools/ecs-migration.yml +++ b/dev-tools/ecs-migration.yml @@ -1151,6 +1151,11 @@ ## NGINX module +- from: nginx.access.remote_ip + to: source.address + alias: true + beat: filebeat + - from: nginx.access.user_name to: user.name alias: true diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 4236704c5fff..e0c4057e60db 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -10786,7 +10786,7 @@ alias to: http.response.body.bytes -- type: alias -alias to: source.ip +alias to: source.address -- diff --git a/filebeat/module/nginx/access/_meta/fields.yml b/filebeat/module/nginx/access/_meta/fields.yml index 28a2005abd7e..cc15701620ef 100644 --- a/filebeat/module/nginx/access/_meta/fields.yml +++ b/filebeat/module/nginx/access/_meta/fields.yml @@ -16,7 +16,7 @@ migration: true - name: remote_ip type: alias - path: source.ip + path: source.address migration: true - name: user_name type: alias diff --git a/filebeat/module/nginx/fields.go b/filebeat/module/nginx/fields.go index 9fedc4e5e8dd..ccb076b619d5 100644 --- a/filebeat/module/nginx/fields.go +++ b/filebeat/module/nginx/fields.go @@ -32,5 +32,5 @@ func init() { // AssetNginx returns asset data. // This is the base64 encoded gzipped contents of module/nginx. func AssetNginx() string { - return "eJy0l8Fu4zgMhu95CqLn1g+QwwKLAgV62MViT3tzFYl2iMqil5Q7k7cf2EnT1JUdy+nolNjm/38UaUt6gFc8bCHUFH5uACJFj1u4+7v/f7cBcKhWqI3EYQt/bAAA/mLXeYSKBVojSqGGuEcYQsBzDRV51GIDoHuWWFoOFdVbiNLhBqAi9E63g9QDBNPgh30/4qHFLdTCXXu6kmDox9MgBJVwMwXQj0u/S09jLaqeL6eMZ8z78cghGgp6shhm5APkqN/znFFSOJdIgg1HLKktPWn89Mg7nhExh9GdGcR+/BmOUcDVyQGe/wHjnKAqagHPEUjBQG8KO7SmUwQaLlpuGg4QGShY3zm8hx0qOdQhU+sJwxgULuTvP1kda7VH41AUPL0ivPz38MTyw4hD1/96Kb6o/YvGg3IndgAnBUGNLOh6rpfjnYLai9Dk7O7YHUrFEIvdIaKmp9eTGd9pTdxvYR9jWwhqy0Gx6LWSMg3VYo6VOPX7TJkzEc6ZrvDsFKXsf2Z69nFFIm6JZ4Nxz27dPP/focYiqbAoXfG5iYovWKimYMahSwx77PINRYnDmozTocu66diTpWWXW93PTa3RxE5TOss4KhRBuaXeExpL7E399Uu0pLnLITC39NPv2DTHeGWBidXgUtLhG9lxNeZTS6Z31Em9yHNZjmkmwjNZboTglEkmAmtRdd6nPoh5KFMK+Ty3oqT7dw3LtFLW21AjT6xwa14EyyFSwBBvmfHTAlojF1f1lk685S5EOZSknPpyrkK7qrgUzrMdHrsdakZpKYxgTRy+qX7zYouLR/HwXQ01I5U5Q9/XStcFp9DekVCE5fcdkgb5rDOS5RDQxiGt9N7Sc6jzTkiPZ00ghyFSRShXThMe3zB3j+m5LlJxS/Y37US2026tcH8CLb5GLvGLq/3iXtC4YpVrg6qmzt3GpqPGfr8CAAD//56RUkQ=" + return "eJy0l8tuo0oQhvd+ilLWCQ/gxZGOIkXK4hyNZjU70u4ucClNF1PVZMZvPwI7iUMaTONMr2yg/v+rC5e+g2c8bCHUFH5vACJFj1u4+b//f7MBcKhWqI3EYQv/bAAA/mPXeYSKBVojSqGGuEcYQsBzDRV51GIDoHuWWFoOFdVbiNLhBqAi9E63g9QdBNPgu32/4qHFLdTCXXs6kmDo18MgBJVwMwXQr3O/c09jLaq+HU4Zz5j3655DNBT0ZDFU5B3kqN/zvKGkcM6RBBuOWFJbetL44ZJXPCNiDqMzM4j9+jcco4CrkwM8fgPjnKAqagGPEUjBQG8KO7SmUwQaDlpuGg4QGShY3zm8hR0qOdQhU+sJwxgUzuRvP1gde7VH41AUPD0jPP24e2D5ZcSh6389FZ/UvqPxoNyJHcBJQVAjC7qe6+l4pqD2LDRZ3R27Q6kYYrE7RNR0eT2Z8ZnWxP0W9jG2haC2HBSLXisp01At5tiJ07zPtDkT4ZTpqZwrjDtFKfufmcZ9XJGIW+LZYNyzW1fsnx1qLJIKi9IVn5uo+IKFagpmHLrEsMcuX1CUOKzJOB26bKSOg1ladrnd/TjZGk3sNKWzjKNCEZRr+j2hscTe1J8fR0uGuxwCc1s/fY9Nc4xfLzDxSjiXdPhCdtyN+dSS6R11UjfyXJZjmonwTJYrIThlkonAWlSd96kHYh7KlEI+z7Uo6fldwzKtlHU31MgTr7k1N4LlEClgiNdU/PQWrZGLi3pLC2+5C1EOJSmnnpyr0C4qLoXzbIfLroeaUVoKI1gThy/q37zY4uZRPHzVQM1IZVbo60bpsuAU2isSirD8vZ3SIJ+1UbIcAto4pJX+tvQc6rxt0v2bJpDDEKkilAtbCo8vmPuN6bkuUnFLvm/aiWyn3VrhfhtafI5c4hdX+8W9oHHFKtcGVU2d+xmbjhr7/QkAAP///8pUUQ==" } diff --git a/libbeat/docs/field-name-changes.asciidoc b/libbeat/docs/field-name-changes.asciidoc index d65b1398d85e..8118d798ebb1 100644 --- a/libbeat/docs/field-name-changes.asciidoc +++ b/libbeat/docs/field-name-changes.asciidoc @@ -231,6 +231,7 @@ |`nginx.access.http_version` |`http.version` |`nginx.access.method` |`http.request.method` |`nginx.access.referrer` |`http.request.referrer` +|`nginx.access.remote_ip` |`source.address` |`nginx.access.response_code` |`http.response.status_code` |`nginx.access.url` |`url.original` |`nginx.access.user_agent.device` |`user_agent.device.name` @@ -295,7 +296,6 @@ |`system.auth.hostname` |`host.hostname` |`system.auth.pid` |`process.pid` |`system.auth.program` |`process.name` -|`system.auth.ssh.event` |`event.action` |`system.auth.ssh.geoip.city_name` |`source.geo.city_name` |`system.auth.ssh.geoip.continent_name` |`source.geo.continent_name` |`system.auth.ssh.geoip.country_iso_code` |`source.geo.country_iso_code`