Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] Change event.kind=error to event.kind=event to comply with ECS #20685

Merged
merged 2 commits into from
Aug 19, 2020
Merged

[Auditbeat] Change event.kind=error to event.kind=event to comply with ECS #20685

merged 2 commits into from
Aug 19, 2020

Conversation

marc-gr
Copy link
Contributor

@marc-gr marc-gr commented Aug 19, 2020

What does this PR do?

Changes event.kind=error occurrences to event.kind=event

Why is it important?

event.kind=error value is not one of the allowed values for the field.
https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-kind.html

Checklist

  • My code follows the style guidelines of this project
    - [] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
    - [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@marc-gr marc-gr requested a review from a team as a code owner August 19, 2020 11:25
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Aug 19, 2020
@marc-gr marc-gr changed the title Change event.kind=error to event.kind=event to coply with ECS Change event.kind=error to event.kind=event to comply with ECS Aug 19, 2020
@marc-gr marc-gr changed the title Change event.kind=error to event.kind=event to comply with ECS [Auditbeat] Change event.kind=error to event.kind=event to comply with ECS Aug 19, 2020
@elasticmachine
Copy link
Collaborator

elasticmachine commented Aug 19, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20685 updated]

  • Start Time: 2020-08-19T11:32:56.294+0000

  • Duration: 33 min 15 sec

Test stats 🧪

Test Results
Failed 0
Passed 230
Skipped 49
Total 279

@marc-gr marc-gr merged commit 8848898 into elastic:master Aug 19, 2020
@marc-gr marc-gr deleted the fix_auditbeat_event-kind branch August 19, 2020 14:41
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@marc-gr @melchiormoulin
[Auditbeat] Change event.kind=error to event.kind=event to comply wit…
e437b4e 
…h ECS (elastic#20685)

* Change event.kind=error to event.kind=event to coply with ECS

* Add CHANGELOG entry
@legoguy1000 legoguy1000 mentioned this pull request Jul 14, 2021
Closed
@andrewkroh
Copy link
Member

@Mergifyio backport. 7.x

mergify bot pushed a commit that referenced this pull request Sep 2, 2021
@marc-gr
[Auditbeat] Change event.kind=error to event.kind=event to comply wit…
049dbea 
…h ECS (#20685)

* Change event.kind=error to event.kind=event to coply with ECS

* Add CHANGELOG entry

(cherry picked from commit 8848898)
@mergify mergify bot mentioned this pull request Sep 2, 2021
Merged
@mergify
Copy link
Contributor

mergify bot commented Sep 2, 2021

Command backport . 7.x: success

Backports have been created

andrewkroh pushed a commit that referenced this pull request Sep 3, 2021
@mergify @marc-gr
[Auditbeat] Change event.kind=error to event.kind=event to comply wit…
ce4f0a1 
…h ECS (#20685) (#27721)

* Change event.kind=error to event.kind=event to coply with ECS

* Add CHANGELOG entry

(cherry picked from commit 8848898)

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees
No one assigned
Labels
Auditbeat breaking change bug ecs review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Auditbeat] System module sets disallowed value ("error") in ECS event.kind field
3 participants
@marc-gr @elasticmachine @andrewkroh