-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Filebeat module expected logs files #21454
Update Filebeat module expected logs files #21454
Conversation
Elasticsearch added country_name to the list of default field for geo in elastic/elasticsearch#62915. So the expected files needed updated.
Pinging @elastic/siem (Team:SIEM) |
@@ -607,7 +607,6 @@ | |||
] | |||
}, | |||
{ | |||
"@timestamp": "2020-10-02T15:00:00.000Z", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
seems odd that this is removed. Looks like the date is in the original log.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It must be from
beats/filebeat/tests/system/test_modules.py
Lines 226 to 257 in 3390aa8
# datasets for which @timestamp is removed due to date missing | |
remove_timestamp = { | |
"activemq.audit", | |
"barracuda.spamfirewall", | |
"barracuda.waf", | |
"bluecoat.director", | |
"cef.log", | |
"cisco.asa", | |
"cisco.ios", | |
"citrix.netscaler", | |
"cyberark.corepas", | |
"cylance.protect", | |
"f5.bigipafm", | |
"fortinet.clientendpoint", | |
"haproxy.log", | |
"icinga.startup", | |
"imperva.securesphere", | |
"infoblox.nios", | |
"iptables.log", | |
"juniper.netscreen", | |
"netscout.sightline", | |
"proofpoint.emailsecurity", | |
"redis.log", | |
"snort.log", | |
"symantec.endpointprotection", | |
"system.auth", | |
"system.syslog", | |
"microsoft.defender_atp", | |
"crowdstrike.falcon_endpoint", | |
"crowdstrike.falcon_audit", | |
"gsuite.admin", | |
"gsuite.config", |
* upstream/master: (27 commits) [Ingest Manager] Split index restrictions into type,dataset, namespace parts (elastic#21406) Update Filebeat module expected logs files (elastic#21454) Edit SQL module docs and fix broken doc structure (elastic#21233) [Ingest Manager] Send snapshot flag together with metadata (elastic#21285) Revert "[JJBB] Set shallow cloning to 10 (elastic#21409)" (elastic#21447) [JJBB] Use reference repo for fast checkouts (elastic#21410) Add initial skeleton of filestream input (elastic#21427) Initial spec file for apm-server (elastic#21225) [Ingest Manager] Upgrade Action: make source URI optional (elastic#21372) Add field limit check for AWS Cloudtrail flattened fields (elastic#21388) [Winlogbeat] Move winlogbeat javascript processor to libbeat (elastic#21402) ci: pipeline to generate the changelog (elastic#21426) [JJBB] Set shallow cloning to 10 (elastic#21409) docs: add link to release notes for 7.9.2 (elastic#21405) (elastic#21419) docs: Prepare Changelog for 7.9.2 (elastic#21229) (elastic#21403) fix: mark flaky tests (elastic#21300) fix: use a fixed version of setuptools (elastic#21393) Move Kubernetes events metricset to its own block in reference config (elastic#21407) [libbeat] Enable WriteAheadLimit in the disk queue (elastic#21391) docs: fix apt/yum formatting (elastic#21362) ...
…ne-2.0-arm * upstream/master: (54 commits) [CI] Change x-pack/auditbeat build events (comments, labels) (elastic#21463) [CI] changeset from elastic#20603 was not added to CI2.0 (elastic#21464) Add new log file reader for filestream input (elastic#21450) [CI] Send slack message with build status (elastic#21428) Remove duplicated sources url in dependencies report (elastic#21462) Add implementation of FSWatcher and FSScanner for filestream (elastic#21444) [Ingest Manager] Split index restrictions into type,dataset, namespace parts (elastic#21406) Update Filebeat module expected logs files (elastic#21454) Edit SQL module docs and fix broken doc structure (elastic#21233) [Ingest Manager] Send snapshot flag together with metadata (elastic#21285) Revert "[JJBB] Set shallow cloning to 10 (elastic#21409)" (elastic#21447) [JJBB] Use reference repo for fast checkouts (elastic#21410) Add initial skeleton of filestream input (elastic#21427) Initial spec file for apm-server (elastic#21225) [Ingest Manager] Upgrade Action: make source URI optional (elastic#21372) Add field limit check for AWS Cloudtrail flattened fields (elastic#21388) [Winlogbeat] Move winlogbeat javascript processor to libbeat (elastic#21402) ci: pipeline to generate the changelog (elastic#21426) [JJBB] Set shallow cloning to 10 (elastic#21409) docs: add link to release notes for 7.9.2 (elastic#21405) (elastic#21419) ...
…ci-build-label-support * upstream/master: [CI] Change x-pack/auditbeat build events (comments, labels) (elastic#21463) [CI] changeset from elastic#20603 was not added to CI2.0 (elastic#21464) Add new log file reader for filestream input (elastic#21450) [CI] Send slack message with build status (elastic#21428) Remove duplicated sources url in dependencies report (elastic#21462) Add implementation of FSWatcher and FSScanner for filestream (elastic#21444) [Ingest Manager] Split index restrictions into type,dataset, namespace parts (elastic#21406) Update Filebeat module expected logs files (elastic#21454) Edit SQL module docs and fix broken doc structure (elastic#21233) [Ingest Manager] Send snapshot flag together with metadata (elastic#21285) Revert "[JJBB] Set shallow cloning to 10 (elastic#21409)" (elastic#21447) [JJBB] Use reference repo for fast checkouts (elastic#21410) Add initial skeleton of filestream input (elastic#21427) Initial spec file for apm-server (elastic#21225) [Ingest Manager] Upgrade Action: make source URI optional (elastic#21372) Add field limit check for AWS Cloudtrail flattened fields (elastic#21388) [Winlogbeat] Move winlogbeat javascript processor to libbeat (elastic#21402) ci: pipeline to generate the changelog (elastic#21426)
Elasticsearch added country_name to the list of default field for geo in elastic/elasticsearch#62915. So the expected files needed updated. (cherry picked from commit 13a5463)
Elasticsearch added country_name to the list of default field for geo in elastic/elasticsearch#62915. So the expected files needed updated. (cherry picked from commit 13a5463)
Elasticsearch added country_name to the list of default field for geo in elastic/elasticsearch#62915. So the expected files needed updated. (cherry picked from commit 13a5463)
Elasticsearch added country_name to the list of default field for geo in elastic/elasticsearch#62915. So the expected files needed updated. (cherry picked from commit 13a5463)
What does this PR do?
Elasticsearch added country_name to the list of default field for geo in elastic/elasticsearch#62915. So the expected files needed updated.
Why is it important?
Fixes broken Filebeat module.
Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Related issues