Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cherry-pick #19379 to 7.x: [Filebeat] Improve ECS categorization field mappings in traefik module #19392

Merged
merged 1 commit into from
Jul 8, 2020
Merged

Cherry-pick #19379 to 7.x: [Filebeat] Improve ECS categorization field mappings in traefik module #19392

merged 1 commit into from
Jul 8, 2020

Conversation

leehinman
Copy link
Contributor

@leehinman leehinman commented Jun 25, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #19379 to 7.x branch. Original message:

What does this PR do?

Improves ECS categorization field mappings in traefik module.
Specifically:

  • event.kind
  • event.category
  • event.type
  • event.outcome
  • related.ip
  • related.user

Why is it important?

ECS categorization fields are used to cross correlate events between
data sources.

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=traefik mage -v pythonIntegTest

Related issues

@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jun 25, 2020
@leehinman leehinman force-pushed the backport_19379_7.x branch from e13c194 to 6d1ff98 Compare June 25, 2020 13:55
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 25, 2020 •
edited
Loading

❕ Build Aborted

Either there was a build timeout or someone aborted the build.'}

Pipeline View Test View Changes Artifacts

Expand to view the summary

Build stats

  • Build Cause: [Pull request #19392 updated]

  • Start Time: 2020-07-08T02:32:50.862+0000

  • Duration: 124 min 48 sec

Test stats 🧪

Test Results
Failed 0
Passed 3538
Skipped 677
Total 4215

Log output

Expand to view the last 100 lines of log output 

[2020-07-08T04:36:13.159Z] 	at hudson.remoting.Engine$1.lambda$newThread$0(Engine.java:93)
[2020-07-08T04:36:13.159Z] Caused: java.lang.InterruptedException: java.lang.InterruptedException: no matches found within 10000
[2020-07-08T04:36:13.159Z] 	at hudson.FilePath.act(FilePath.java:1071)
[2020-07-08T04:36:13.159Z] 	at hudson.FilePath.act(FilePath.java:1058)
[2020-07-08T04:36:13.159Z] 	at hudson.FilePath.validateAntFileMask(FilePath.java:2684)
[2020-07-08T04:36:13.159Z] 	at hudson.tasks.ArtifactArchiver.perform(ArtifactArchiver.java:265)
[2020-07-08T04:36:13.159Z] 	at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:80)
[2020-07-08T04:36:13.159Z] 	at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:67)
[2020-07-08T04:36:13.159Z] 	at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
[2020-07-08T04:36:13.159Z] 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
[2020-07-08T04:36:13.159Z] 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
[2020-07-08T04:36:13.159Z] 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
[2020-07-08T04:36:13.159Z] 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
[2020-07-08T04:36:13.159Z] 	at java.lang.Thread.run(Thread.java:748)
[2020-07-08T04:36:13.159Z] No artifacts found that match the file pattern "**/build/TEST*.out". Configuration error?
[2020-07-08T04:36:13.373Z] + FILE=auditbeat/build/coverage/full.cov
[2020-07-08T04:36:13.373Z] + [ -f auditbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.373Z] + FILE=filebeat/build/coverage/full.cov
[2020-07-08T04:36:13.373Z] + [ -f filebeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.373Z] + FILE=heartbeat/build/coverage/full.cov
[2020-07-08T04:36:13.373Z] + [ -f heartbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.373Z] + FILE=libbeat/build/coverage/full.cov
[2020-07-08T04:36:13.373Z] + [ -f libbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.373Z] + FILE=metricbeat/build/coverage/full.cov
[2020-07-08T04:36:13.373Z] + [ -f metricbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.373Z] + FILE=packetbeat/build/coverage/full.cov
[2020-07-08T04:36:13.374Z] + [ -f packetbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.374Z] + FILE=winlogbeat/build/coverage/full.cov
[2020-07-08T04:36:13.374Z] + [ -f winlogbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.374Z] + FILE=journalbeat/build/coverage/full.cov
[2020-07-08T04:36:13.374Z] + [ -f journalbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.551Z] + curl -sSLo codecov https://codecov.io/bash
[2020-07-08T04:36:13.824Z] + FILE=auditbeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f auditbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.824Z] + FILE=filebeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f filebeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.824Z] + FILE=heartbeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f heartbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.824Z] + FILE=libbeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f libbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.824Z] + FILE=metricbeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f metricbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.824Z] + FILE=packetbeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f packetbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.824Z] + FILE=winlogbeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f winlogbeat/build/coverage/full.cov ]
[2020-07-08T04:36:13.824Z] + FILE=journalbeat/build/coverage/full.cov
[2020-07-08T04:36:13.824Z] + [ -f journalbeat/build/coverage/full.cov ]
[2020-07-08T04:36:14.537Z] Failed in branch Filebeat x-pack
[2020-07-08T04:36:15.065Z] Failed in branch Filebeat oss
[2020-07-08T04:36:15.311Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats
[2020-07-08T04:36:15.671Z] + find . -type f -name TEST*.xml -path */build/* -delete
[2020-07-08T04:36:15.685Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats/Lint
[2020-07-08T04:36:15.912Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats/Filebeat-x-pack-Mac-OS-X
[2020-07-08T04:36:16.118Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats/Filebeat-Mac-OS-X
[2020-07-08T04:36:16.309Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats/Filebeat-x-pack-Windows
[2020-07-08T04:36:16.488Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats/Filebeat-Windows
[2020-07-08T04:36:16.675Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats/Filebeat-x-pack
[2020-07-08T04:36:16.844Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats/Filebeat-oss
[2020-07-08T04:36:17.263Z] + cat
[2020-07-08T04:36:17.263Z] + /usr/local/bin/runbld ./runbld-script
[2020-07-08T04:36:17.264Z] Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=UTF8
[2020-07-08T04:36:23.873Z] runbld>>> runbld started
[2020-07-08T04:36:23.873Z] runbld>>> 1.6.12/f45d832f2ba0aa2722ab4ec1fda8ad140f027f8b
[2020-07-08T04:36:25.792Z] runbld>>> The following profiles matched the job 'Beats/beats-beats-mbp/PR-19392' in order of occurrence in the config (last value wins).
[2020-07-08T04:36:26.737Z] runbld>>> Debug logging enabled.
[2020-07-08T04:36:26.737Z] runbld>>> Storing result
[2020-07-08T04:36:26.999Z] runbld>>> Store result: created {:total 2, :successful 2, :failed 0} 1
[2020-07-08T04:36:26.999Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200708043626-C1859130
[2020-07-08T04:36:26.999Z] runbld>>> Adding system facts.
[2020-07-08T04:36:27.942Z] runbld>>> Adding vcs info for the latest commit:  d5d133858efd9c7301fbac6264892a5ecdc3e8f7
[2020-07-08T04:36:27.942Z] runbld>>> >>>>>>>>>>>> SCRIPT EXECUTION BEGIN >>>>>>>>>>>>
[2020-07-08T04:36:27.942Z] runbld>>> Adding /usr/lib/jvm/java-8-openjdk-amd64/bin to the path.
[2020-07-08T04:36:27.942Z] + echo 'Processing JUnit reports with runbld...'
[2020-07-08T04:36:27.942Z] Processing JUnit reports with runbld...
[2020-07-08T04:36:28.514Z] runbld>>> <<<<<<<<<<<< SCRIPT EXECUTION END <<<<<<<<<<<<
[2020-07-08T04:36:28.514Z] runbld>>> DURATION: 16ms
[2020-07-08T04:36:28.514Z] runbld>>> STDOUT: 40 bytes
[2020-07-08T04:36:28.514Z] runbld>>> STDERR: 49 bytes
[2020-07-08T04:36:28.514Z] runbld>>> WRAPPED PROCESS: SUCCESS (0)
[2020-07-08T04:36:28.514Z] runbld>>> Searching for build metadata in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats
[2020-07-08T04:36:29.465Z] runbld>>> Storing build metadata: 
[2020-07-08T04:36:29.465Z] runbld>>> Adding test report.
[2020-07-08T04:36:29.465Z] runbld>>> Searching for junit test output files with the pattern: TEST-.*\.xml$ in: /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392/src/github.com/elastic/beats
[2020-07-08T04:36:30.410Z] runbld>>> Found 11 test output files
[2020-07-08T04:36:31.358Z] runbld>>> Test output logs contained: Errors: 0 Failures: 0 Tests: 4215 Skipped: 653
[2020-07-08T04:36:31.625Z] runbld>>> Storing result
[2020-07-08T04:36:31.625Z] runbld>>> FAILURES: 0
[2020-07-08T04:36:31.887Z] runbld>>> Store result: updated {:total 2, :successful 2, :failed 0} 2
[2020-07-08T04:36:31.887Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200708043626-C1859130
[2020-07-08T04:36:31.887Z] runbld>>> Email notification disabled by environment variable.
[2020-07-08T04:36:31.887Z] runbld>>> Slack notification disabled by environment variable.
[2020-07-08T04:36:37.943Z] Running on worker-395930 in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19392
[2020-07-08T04:36:38.177Z] [INFO] getVaultSecret: Getting secrets
[2020-07-08T04:36:38.236Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2020-07-08T04:36:40.287Z] + chmod 755 generate-build-data.sh
[2020-07-08T04:36:40.288Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19392/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19392/runs/15 ABORTED 7428026
[2020-07-08T04:36:40.288Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19392/runs/15/steps/?limit=10000 -o steps-info.json
[2020-07-08T04:36:41.741Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19392/runs/15/tests/?status=FAILED -o tests-errors.json
[2020-07-08T04:36:42.450Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19392/runs/15/log/ -o pipeline-log.txt

@leehinman leehinman force-pushed the backport_19379_7.x branch from ad06f17 to b2d61a9 Compare July 1, 2020 18:24
@leehinman
Copy link
Contributor Author

run tests

1 similar comment
@leehinman
Copy link
Contributor Author

run tests

@leehinman leehinman force-pushed the backport_19379_7.x branch from b2d61a9 to f565980 Compare July 7, 2020 20:25
@leehinman
Improve ECS categorization field mappings in traefik module (elastic#…
d5d1338 
…19379)

- event.kind
- event.category
- event.type
- event.outcome
- related.ip
- related.user

Closes elastic#16183

(cherry picked from commit f814f41)
@leehinman leehinman force-pushed the backport_19379_7.x branch from f565980 to d5d1338 Compare July 8, 2020 02:32
@leehinman leehinman merged commit 72c5c29 into elastic:7.x Jul 8, 2020
@leehinman leehinman deleted the backport_19379_7.x branch July 8, 2020 13:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees
No one assigned
Labels
backport [zube]: Done
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@leehinman @elasticmachine @andrewkroh