Skip to content

Commit

Permalink
Introduce migration script for data in Kibana files (#9998)
Browse files Browse the repository at this point in the history 
With 7.x the data structure of the modules was changed to ECS. This has an affect on all Kibana files as the fields changed. For the migration from 6.x to 7.x it is necessary that 6.x and 7.x dashboards can coexist. To not overwrite dashboards in 7.x all Kibana files must have a changed id and to differentiate them in the UI, a different title.

This PR does the following changes:

* Reads all changed files from ecs-migration.yml and replaces these fields in all Kibana files. It also replaces fields inside queries and filters
* Reads all ids used in the Kibana files and postfixes these ids with `-7x`. It also replaces ids existing in links between dashboards.
* Reads all titles in the Kibana files and appends ` 7.x` to the titles.

The change is impemented so the script can be run multiple times. This is helpful if we make changes later on again to a few dashboards we can rerun the script without having double changes.
  • Loading branch information
@ruflin
ruflin authored Feb 5, 2019
1 parent 9fdc387 commit 7120870
Show file tree
Hide file tree
Showing 91 changed files with 3,194 additions and 3,074 deletions.
44 changes: 22 additions & 22 deletions auditbeat/module/auditd/_meta/kibana/7/dashboard/auditbeat-kernel-executions.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@
}
}
},
"savedSearchId": "d382f5b0-c1c6-11e7-8995-936807a28b16",
"title": "Error Codes [Auditbeat Auditd Executions]",
"savedSearchId": "d382f5b0-c1c6-11e7-8995-936807a28b16-ecs",
"title": "Error Codes [Auditbeat Auditd Executions] ECS",
"uiStateJSON": {},
"version": 1,
"visState": {
Expand Down Expand Up @@ -46,11 +46,11 @@
"legendPosition": "right",
"type": "pie"
},
"title": "Error Codes [Auditbeat Auditd Executions]",
"title": "Error Codes [Auditbeat Auditd Executions] ECS",
"type": "pie"
}
},
"id": "20a8e8d0-c1c8-11e7-8995-936807a28b16",
"id": "20a8e8d0-c1c8-11e7-8995-936807a28b16-ecs",
"type": "visualization",
"updated_at": "2018-01-16T22:10:23.921Z",
"version": 4
Expand All @@ -68,7 +68,7 @@
}
}
},
"title": "Primary Username Tag Cloud [Auditbeat Auditd]",
"title": "Primary Username Tag Cloud [Auditbeat Auditd] ECS",
"uiStateJSON": {},
"version": 1,
"visState": {
Expand Down Expand Up @@ -99,11 +99,11 @@
"orientation": "single",
"scale": "linear"
},
"title": "Primary Username Tag Cloud [Auditbeat Auditd]",
"title": "Primary Username Tag Cloud [Auditbeat Auditd] ECS",
"type": "tagcloud"
}
},
"id": "f81a6de0-c1c1-11e7-8995-936807a28b16",
"id": "f81a6de0-c1c1-11e7-8995-936807a28b16-ecs",
"type": "visualization",
"updated_at": "2018-01-16T22:12:18.730Z",
"version": 3
Expand All @@ -120,8 +120,8 @@
}
}
},
"savedSearchId": "d382f5b0-c1c6-11e7-8995-936807a28b16",
"title": "Exe Name Tag Cloud [Auditbeat Auditd Executions]",
"savedSearchId": "d382f5b0-c1c6-11e7-8995-936807a28b16-ecs",
"title": "Exe Name Tag Cloud [Auditbeat Auditd Executions] ECS",
"uiStateJSON": {},
"version": 1,
"visState": {
Expand All @@ -137,7 +137,7 @@
"enabled": true,
"id": "2",
"params": {
"field": "process.exe",
"field": "process.executable",
"order": "desc",
"orderBy": "1",
"size": 10
Expand All @@ -152,23 +152,23 @@
"orientation": "single",
"scale": "linear"
},
"title": "Exe Name Tag Cloud [Auditbeat Auditd Executions]",
"title": "Exe Name Tag Cloud [Auditbeat Auditd Executions] ECS",
"type": "tagcloud"
}
},
"id": "2efac370-c1ca-11e7-8995-936807a28b16",
"id": "2efac370-c1ca-11e7-8995-936807a28b16-ecs",
"type": "visualization",
"updated_at": "2018-01-16T22:57:41.411Z",
"version": 4
},
{
"attributes": {
"columns": [
"beat.hostname",
"agent.hostname",
"process.args",
"auditd.summary.actor.primary",
"auditd.summary.actor.secondary",
"process.exe"
"process.executable"
],
"description": "",
"hits": 0,
Expand Down Expand Up @@ -241,10 +241,10 @@
"@timestamp",
"desc"
],
"title": "Process Executions [Auditbeat Auditd]",
"title": "Process Executions [Auditbeat Auditd] ECS",
"version": 1
},
"id": "d382f5b0-c1c6-11e7-8995-936807a28b16",
"id": "d382f5b0-c1c6-11e7-8995-936807a28b16-ecs",
"type": "search",
"updated_at": "2018-01-16T22:26:35.050Z",
"version": 5
Expand Down Expand Up @@ -277,7 +277,7 @@
"x": 4,
"y": 0
},
"id": "20a8e8d0-c1c8-11e7-8995-936807a28b16",
"id": "20a8e8d0-c1c8-11e7-8995-936807a28b16-ecs",
"panelIndex": "1",
"type": "visualization",
"version": "6.2.4"
Expand All @@ -290,7 +290,7 @@
"x": 8,
"y": 0
},
"id": "f81a6de0-c1c1-11e7-8995-936807a28b16",
"id": "f81a6de0-c1c1-11e7-8995-936807a28b16-ecs",
"panelIndex": "3",
"type": "visualization",
"version": "6.2.4"
Expand All @@ -303,7 +303,7 @@
"x": 0,
"y": 0
},
"id": "2efac370-c1ca-11e7-8995-936807a28b16",
"id": "2efac370-c1ca-11e7-8995-936807a28b16-ecs",
"panelIndex": "5",
"type": "visualization",
"version": "6.2.4"
Expand All @@ -316,17 +316,17 @@
"x": 0,
"y": 3
},
"id": "d382f5b0-c1c6-11e7-8995-936807a28b16",
"id": "d382f5b0-c1c6-11e7-8995-936807a28b16-ecs",
"panelIndex": "6",
"type": "search",
"version": "6.2.4"
}
],
"timeRestore": false,
"title": "[Auditbeat Auditd] Executions",
"title": "[Auditbeat Auditd] Executions ECS",
"version": 1
},
"id": "7de391b0-c1ca-11e7-8995-936807a28b16",
"id": "7de391b0-c1ca-11e7-8995-936807a28b16-ecs",
"type": "dashboard",
"updated_at": "2018-01-16T22:58:11.243Z",
"version": 5
Expand Down
30 changes: 15 additions & 15 deletions auditbeat/module/auditd/_meta/kibana/7/dashboard/auditbeat-kernel-overview.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
"kibanaSavedObjectMeta": {
"searchSourceJSON": {}
},
"title": "Event Actions [Auditbeat Auditd Overview]",
"title": "Event Actions [Auditbeat Auditd Overview] ECS",
"uiStateJSON": {},
"version": 1,
"visState": {
Expand Down Expand Up @@ -65,11 +65,11 @@
"time_field": "@timestamp",
"type": "timeseries"
},
"title": "Event Actions [Auditbeat Auditd Overview]",
"title": "Event Actions [Auditbeat Auditd Overview] ECS",
"type": "metrics"
}
},
"id": "97680df0-c1c0-11e7-8995-936807a28b16",
"id": "97680df0-c1c0-11e7-8995-936807a28b16-ecs",
"type": "visualization",
"updated_at": "2018-01-16T22:11:01.438Z",
"version": 3
Expand All @@ -87,8 +87,8 @@
}
}
},
"savedSearchId": "0f10c430-c1c3-11e7-8995-936807a28b16",
"title": "Event Categories [Auditbeat Auditd]",
"savedSearchId": "0f10c430-c1c3-11e7-8995-936807a28b16-ecs",
"title": "Event Categories [Auditbeat Auditd] ECS",
"uiStateJSON": {},
"version": 1,
"visState": {
Expand Down Expand Up @@ -134,19 +134,19 @@
"legendPosition": "right",
"type": "pie"
},
"title": "Event Categories [Auditbeat Auditd]",
"title": "Event Categories [Auditbeat Auditd] ECS",
"type": "pie"
}
},
"id": "08679220-c25a-11e7-8692-232bd1143e8a",
"id": "08679220-c25a-11e7-8692-232bd1143e8a-ecs",
"type": "visualization",
"updated_at": "2018-01-16T22:54:10.330Z",
"version": 4
},
{
"attributes": {
"columns": [
"beat.hostname",
"agent.hostname",
"auditd.summary.actor.primary",
"auditd.summary.actor.secondary",
"event.action",
Expand Down Expand Up @@ -201,10 +201,10 @@
"@timestamp",
"desc"
],
"title": "Audit Event Table [Auditbeat Auditd]",
"title": "Audit Event Table [Auditbeat Auditd] ECS",
"version": 1
},
"id": "0f10c430-c1c3-11e7-8995-936807a28b16",
"id": "0f10c430-c1c3-11e7-8995-936807a28b16-ecs",
"type": "search",
"updated_at": "2018-01-16T22:51:24.572Z",
"version": 4
Expand Down Expand Up @@ -237,7 +237,7 @@
"x": 0,
"y": 0
},
"id": "97680df0-c1c0-11e7-8995-936807a28b16",
"id": "97680df0-c1c0-11e7-8995-936807a28b16-ecs",
"panelIndex": "1",
"type": "visualization",
"version": "6.2.4"
Expand All @@ -250,7 +250,7 @@
"x": 7,
"y": 0
},
"id": "08679220-c25a-11e7-8692-232bd1143e8a",
"id": "08679220-c25a-11e7-8692-232bd1143e8a-ecs",
"panelIndex": "4",
"type": "visualization",
"version": "6.2.4"
Expand All @@ -263,17 +263,17 @@
"x": 0,
"y": 3
},
"id": "0f10c430-c1c3-11e7-8995-936807a28b16",
"id": "0f10c430-c1c3-11e7-8995-936807a28b16-ecs",
"panelIndex": "5",
"type": "search",
"version": "6.2.4"
}
],
"timeRestore": false,
"title": "[Auditbeat Auditd] Overview",
"title": "[Auditbeat Auditd] Overview ECS",
"version": 1
},
"id": "c0ac2c00-c1c0-11e7-8995-936807a28b16",
"id": "c0ac2c00-c1c0-11e7-8995-936807a28b16-ecs",
"type": "dashboard",
"updated_at": "2018-01-16T22:55:17.775Z",
"version": 5
Expand Down
Loading

0 comments on commit 7120870

Please sign in to comment.