Fix field alias for nginx.access.remote_ip #11512
Conversation
- This adds the missing nginx field alias - This also introduces an update introduced in elastic#11334
webmat
added
ecs
needs_backport
|
Will this update the filebeat nginx dashboards as well, as I'm fairly certain there are some visualizations that still point to nginx.access.remote_ip.
|
|
@EthanStrider Ah indeed. The updates to kibana objects have also been done with the file that was missing this entry. I'll update this as well. |
|
I don't know if you want to try to address this issue: #11517 in this PR, but mentioning it in case you do. |
|
@EthanStrider Ok, the source of this job is here: https://github.com/elastic/kibana/blob/7.0/x-pack/plugins/ml/server/models/data_recognizer/modules/nginx_ecs/ml/source_ip_request_rate_ecs.json It appears like it's been adjusted to use the ECS fields directly in January (elastic/kibana#29383), so this should be in 7.0-rc1. How did you get this ML content installed, are you using 7.0-rc1? |
|
Wait, I take that back. It may be fine over in that repo. But when playing with Beats locally, the wrong file seems to be pulled in, referencing the old field name. |
|
jenkins, test this |
- It was missing in the breaking changes doc (generated from ecs-migration.yml) - The actual field alias was incorrectly pointing to source.ip, this has been adjusted to source.address - Re-generating the documentation file also updated the breaking changes to include a change introduced in elastic#11334 This should be backported to 7.0. Closes elastic#11510 (cherry picked from commit 692ef9e)
ruflin
added
v7.0.0
and removed
needs_backport
- It was missing in the breaking changes doc (generated from ecs-migration.yml) - The actual field alias was incorrectly pointing to source.ip, this has been adjusted to source.address - Re-generating the documentation file also updated the breaking changes to include a change introduced in #11334 This should be backported to 7.0. Closes #11510 (cherry picked from commit 692ef9e)
adjusted to source.address
include a change introduced in Adding categorization fields for the system/auth module #11334
This should be backported to 7.0.
Closes #11510