Cherry-pick #21624 to 7.x: [Filebeat S3] Change log.file.path to be nested object #21636

kaiyan-sheng · 2020-10-07T14:24:54Z

Cherry-pick of PR #21624 to 7.x branch. Original message:

This PR is to change log.file.path to be nested object instead of using file.path as field name.

(cherry picked from commit 030077c)

elasticmachine · 2020-10-07T14:24:57Z

Pinging @elastic/integrations-platforms (Team:Platforms)

elasticmachine · 2020-10-07T15:49:01Z

💔 Tests Failed

Expand to view the summary

Build stats

Build Cause: [Pull request #21636 opened]
Start Time: 2020-10-07T14:25:43.455+0000
Duration: 83 min 0 sec

Test stats 🧪

Test	Results
Failed	182
Passed	1765
Skipped	259
Total	2206

Test errors

Expand to view the tests failures

Name: Build&Test / x-pack/filebeat-build / test_fileset_file_000_envoyproxy – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 32.519
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'kubernetes.container.name': 'ambassador', 'kubernetes.node.name': 'minikube', 'kubernetes.pod.uid': 'e57d545e-2a9d-11e9-995f-08002730e0dc', 'kubernetes.pod.name': 'ambassador-76c58d9df4-jwhsg', 'kubernetes.namespace': 'default', 'kubernetes.labels.service': 'ambassador', 'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.region_iso_code': 'US-VA', 'destination.geo.city_name': 'Ashburn', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.region_name': 'Virginia', 'destination.geo.location.lon': -77.4728, 'destination.geo.location.lat': 39.0481, 'destination.as.number': 14618, 'destination.as.organization.name': 'Amazon.com, Inc.', 'destination.address': '52.71.234.219', 'destination.port': 80, 'destination.ip': '52.71.234.219', 'source.address': '172.17.0.3', 'source.ip': '172.17.0.3', 'network.protocol': 'http', 'related.ip': ['172.17.0.3', '52.71.234.219'], 'event.duration': 180000000, 'event.kind': 'event', 'event.module': 'envoyproxy', 'event.type': ['connection', 'protocol'], 'event.category': ['network'], 'event.dataset': 'envoyproxy.log', 'event.outcome': ['success'], 'user_agent.original': 'curl/7.59.0', 'user_agent.name': 'curl', 'user_agent.device.name': 'Other', 'user_agent.version': '7.59.0', 'fileset.name': 'log', 'message': 'ACCESS [2019-04-10T03:49:34.451Z] "GET /httpbin/status/501 HTTP/1.1" 501 - 0 0 180 179 "172.17.0.3" "curl/7.59.0" "413bf460-bd56-4515-ada4-2a69c5e78e54" "httpbin.org" "52.71.234.219:80"', 'envoyproxy.log_type': 'ACCESS', 'envoyproxy.authority': 'httpbin.org', 'envoyproxy.upstream_service_time': 179000000, 'envoyproxy.request_id': '413bf460-bd56-4515-ada4-2a69c5e78e54', 'envoyproxy.proxy_type': 'http', 'url.path': '/httpbin/status/501', 'url.domain': 'httpbin.org', 'tags': ['envoyproxy'], 'input.type': 'log', '@timestamp': '2019-04-10T03:49:34.451Z', 'service.type': 'envoyproxy', 'http.request.method': 'GET', 'http.request.body.bytes': 0, 'http.response.status_code': 501, 'http.response.body.bytes': 0, 'http.version': '1.1'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_001_envoyproxy – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 4.058
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 399, 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 54113, 'destination.as.organization.name': 'Fastly', 'destination.address': '151.101.66.217', 'destination.port': 80, 'destination.ip': '151.101.66.217', 'source.address': '172.17.0.3', 'source.ip': '172.17.0.3', 'network.protocol': 'http', 'related.ip': ['172.17.0.3', '151.101.66.217'], 'event.duration': 41000000, 'event.kind': 'event', 'event.module': 'envoyproxy', 'event.type': ['connection', 'protocol'], 'event.category': ['network'], 'event.dataset': 'envoyproxy.log', 'event.outcome': ['success'], 'user_agent.original': 'curl/7.59.0', 'user_agent.name': 'curl', 'user_agent.device.name': 'Other', 'user_agent.version': '7.59.0', 'message': '[2019-04-11T00:51:07.980Z] "GET /elastic/ HTTP/1.1" 301 - 0 0 41 39 "172.17.0.3" "curl/7.59.0" "078d1daa-b786-4d6d-85a5-7e4366adaa19" "www.elastic.co" "151.101.66.217:80"', 'fileset.name': 'log', 'envoyproxy.log_type': 'ACCESS', 'envoyproxy.authority': 'www.elastic.co', 'envoyproxy.upstream_service_time': 39000000, 'envoyproxy.request_id': '078d1daa-b786-4d6d-85a5-7e4366adaa19', 'envoyproxy.proxy_type': 'http', 'url.path': '/elastic/', 'url.domain': 'www.elastic.co', 'tags': ['envoyproxy'], 'input.type': 'log', '@timestamp': '2019-04-11T00:51:07.980Z', 'service.type': 'envoyproxy', 'http.request.method': 'GET', 'http.request.body.bytes': 0, 'http.response.status_code': 301, 'http.response.body.bytes': 0, 'http.version': '1.1'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_002_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 5.305
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['source.geo.country_name']]}, full object: {'log.offset': 0, 'log.level': 'informational', 'source.geo.continent_name': 'Europe', 'source.geo.region_iso_code': 'RU-MOW', 'source.geo.city_name': 'Moscow', 'source.geo.country_iso_code': 'RU', 'source.geo.country_name': 'Russia', 'source.geo.region_name': 'Moscow', 'source.geo.location.lon': 37.6172, 'source.geo.location.lat': 55.7527, 'source.address': '1.2.3.4', 'source.ip': '1.2.3.4', 'fileset.name': 'asa', 'tags': ['cisco-asa', 'forwarded'], 'input.type': 'log', 'observer.product': 'asa', 'observer.vendor': 'Cisco', 'observer.type': 'firewall', 'related.ip': ['1.2.3.4'], 'service.type': 'cisco', 'event.severity': 6, 'event.code': 734001, 'event.original': '%ASA-6-734001: DAP: User firsname.lastname@domain.net, Addr 1.2.3.4, Connection AnyConnect: The following DAP records were selected for this connection: dap_1, dap_2', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'cisco', 'event.action': 'firewall-rule', 'event.category': ['network'], 'event.type': ['info'], 'event.dataset': 'cisco.asa', 'user.email': 'firsname.lastname@domain.net', 'cisco.asa.connection_type': 'AnyConnect', 'cisco.asa.dap_records': ['dap_1', 'dap_2'], 'cisco.asa.message_id': '734001'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['source.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_003_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 4.554
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 1723, 'log.level': 'alert', 'destination.geo.continent_name': 'Asia', 'destination.geo.region_iso_code': 'CN-GD', 'destination.geo.country_iso_code': 'CN', 'destination.geo.country_name': 'China', 'destination.geo.region_name': 'Guangdong', 'destination.geo.location.lon': 113.25, 'destination.geo.location.lat': 23.1167, 'destination.address': '1.2.33.40', 'destination.port': 8080, 'destination.ip': '1.2.33.40', 'source.address': '10.1.2.3', 'source.port': 64321, 'source.ip': '10.1.2.3', 'fileset.name': 'asa', 'tags': ['cisco-asa', 'forwarded'], 'network.transport': 'icmp', 'network.iana_number': 1, 'input.type': 'log', 'observer.ingress.interface.name': 'outside', 'observer.product': 'asa', 'observer.vendor': 'Cisco', 'observer.type': 'firewall', 'observer.egress.interface.name': 'inside', 'related.ip': ['10.1.2.3', '1.2.33.40'], 'related.user': ['joe'], 'service.type': 'cisco', 'event.severity': 1, 'event.code': 106103, 'event.original': '%ASA-1-106103: access-list filter denied icmp for user joe inside/10.1.2.3(64321) -> outside/1.2.33.40(8080) hit-cnt 1 first hit [0x3c8b88c1, 0xbee595c3]', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'cisco', 'event.action': 'firewall-rule', 'event.category': ['network'], 'event.type': ['info', 'denied'], 'event.dataset': 'cisco.asa', 'event.outcome': 'deny', 'user.name': 'joe', 'cisco.asa.destination_interface': 'outside', 'cisco.asa.rule_name': 'filter', 'cisco.asa.source_interface': 'inside', 'cisco.asa.message_id': '106103'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_005_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 8.545
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 3172, 'log.level': 'critical', 'destination.geo.continent_name': 'North America', 'destination.geo.region_iso_code': 'US-CA', 'destination.geo.city_name': 'Thousand Oaks', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.region_name': 'California', 'destination.geo.location.lon': -118.8199, 'destination.geo.location.lat': 34.197, 'destination.as.number': 395776, 'destination.as.organization.name': 'FEDERAL ONLINE GROUP LLC', 'destination.address': '192.186.2.2', 'destination.port': 53356, 'destination.ip': '192.186.2.2', 'source.address': '10.10.10.10', 'source.port': 161, 'source.ip': '10.10.10.10', 'fileset.name': 'asa', 'tags': ['cisco-asa', 'forwarded'], 'network.bytes': 64585, 'network.transport': 'udp', 'network.iana_number': 17, 'input.type': 'log', 'observer.ingress.interface.name': 'net', 'observer.hostname': 'dev01', 'observer.product': 'asa', 'observer.vendor': 'Cisco', 'observer.type': 'firewall', 'observer.egress.interface.name': 'intfacename', 'related.hosts': ['dev01', 'dev01'], 'related.ip': ['10.10.10.10', '192.186.2.2'], 'service.type': 'cisco', 'host.hostname': 'dev01', 'event.severity': 2, 'event.code': 302016, 'event.original': '%ASA-2-302016: Teardown UDP connection 1671727 for intfacename:10.10.10.10/161 to net:192.186.2.2/53356 duration 0:02:04 bytes 64585', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'cisco', 'event.start': '2020-05-05T20:38:46.000Z', 'event.type': ['connection', 'end'], 'event.duration': 124000000000, 'event.action': 'flow-expiration', 'event.end': '2020-05-05T18:40:50.000-02:00', 'event.category': ['network'], 'event.dataset': 'cisco.asa', 'cisco.asa.destination_interface': 'net', 'cisco.asa.connection_id': '1671727', 'cisco.asa.source_interface': 'intfacename', 'cisco.asa.message_id': '302016'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_011_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 5.847
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 3639, 'log.level': 'alert', 'destination.geo.continent_name': 'Europe', 'destination.geo.region_iso_code': 'DE-ST', 'destination.geo.city_name': 'Magdeburg', 'destination.geo.country_iso_code': 'DE', 'destination.geo.country_name': 'Germany', 'destination.geo.region_name': 'Saxony-Anhalt', 'destination.geo.location.lon': 11.6167, 'destination.geo.location.lat': 52.1333, 'destination.as.number': 43341, 'destination.as.organization.name': 'MDlink online service center GmbH', 'destination.address': '213.211.198.62', 'destination.port': 80, 'destination.ip': '213.211.198.62', 'source.address': '10.0.1.20', 'source.port': 46004, 'source.ip': '10.0.1.20', 'fileset.name': 'ftd', 'url.original': 'http://www.eicar.org/download/eicar_com.zip', 'tags': ['cisco-ftd', 'forwarded'], 'network.protocol': 'http', 'network.application': 'curl', 'network.transport': 'tcp', 'network.iana_number': 6, 'input.type': 'log', 'observer.hostname': 'firepower', 'observer.product': 'ftd', 'observer.vendor': 'Cisco', 'observer.type': 'firewall', '@timestamp': '2019-08-16T07:39:03.000-02:00', 'file.size': '184', 'file.name': 'eicar_com.zip', 'file.hash.sha256': '2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad', 'related.hosts': ['firepower', 'firepower'], 'related.ip': ['10.0.1.20', '213.211.198.62'], 'related.user': ['No Authentication Required'], 'related.hash': ['2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad'], 'service.type': 'cisco', 'host.hostname': 'firepower', 'event.severity': 1, 'event.code': 430005, 'event.original': '%FTD-1-430005: SrcIP: 10.0.1.20, DstIP: 213.211.198.62, SrcPort: 46004, DstPort: 80, Protocol: tcp, FileDirection: Download, FileAction: Malware Cloud Lookup, FileSHA256: 2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad, SHA_Disposition: Unavailable, SperoDisposition: Spero detection not performed on file, ThreatName: Win.Ransomware.Eicar::95.sbx.tg, FileName: eicar_com.zip, FileType: ZIP, FileSize: 184, ApplicationProtocol: HTTP, Client: cURL, User: No Authentication Required, FirstPacketSecond: 2019-08-16T09:39:02Z, FilePolicy: malware-and-file-policy, FileStorageStatus: Not Stored (Disposition Was Pending), FileSandboxStatus: File Size Is Too Small, URI: http://www.eicar.org/download/eicar_com.zip', 'event.timezone': '-02:00', 'event.kind': 'alert', 'event.module': 'cisco', 'event.start': '2019-08-16T09:39:02Z', 'event.action': 'malware-detected', 'event.category': ['malware'], 'event.type': ['info'], 'event.dataset': 'cisco.ftd', 'user.name': 'No Authentication Required', 'user.id': 'No Authentication Required', 'cisco.ftd.security.file_policy': 'malware-and-file-policy', 'cisco.ftd.security.sha_disposition': 'Unavailable', 'cisco.ftd.security.file_name': 'eicar_com.zip', 'cisco.ftd.security.file_action': 'Malware Cloud Lookup', 'cisco.ftd.security.spero_disposition': 'Spero detection not performed on file', 'cisco.ftd.security.first_packet_second': '2019-08-16T09:39:02Z', 'cisco.ftd.security.file_sandbox_status': 'File Size Is Too Small', 'cisco.ftd.security.uri': 'http://www.eicar.org/download/eicar_com.zip', 'cisco.ftd.security.file_sha256': '2546dcffc5ad854d4ddc64fbf056871cd5a00f2471cb7a5bfd4ac23b6e9eedad', 'cisco.ftd.security.dst_ip': '213.211.198.62', 'cisco.ftd.security.file_size': '184', 'cisco.ftd.security.src_port': '46004', 'cisco.ftd.security.src_ip': '10.0.1.20', 'cisco.ftd.security.file_storage_status': 'Not Stored (Disposition Was Pending)', 'cisco.ftd.security.protocol': 'tcp', 'cisco.ftd.security.application_protocol': 'HTTP', 'cisco.ftd.security.threat_name': 'Win.Ransomware.Eicar::95.sbx.tg', 'cisco.ftd.security.file_direction': 'Download', 'cisco.ftd.security.file_type': 'ZIP', 'cisco.ftd.security.dst_port': '80', 'cisco.ftd.security.client': 'cURL', 'cisco.ftd.security.user': 'No Authentication Required', 'cisco.ftd.rule_name': 'malware-and-file-policy', 'cisco.ftd.message_id': '430005', 'cisco.ftd.threat_category': 'Win.Ransomware.Eicar::95.sbx.tg'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_012_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 6.219
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 1182, 'log.level': 'alert', 'dns.response_code': 'NOERROR', 'dns.question.name': 'eu-central-1.ec2.archive.ubuntu.com', 'dns.question.type': 'A', 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 15169, 'destination.as.organization.name': 'Google LLC', 'destination.address': '8.8.8.8', 'destination.port': 53, 'destination.bytes': 0, 'destination.ip': '8.8.8.8', 'destination.packets': 0, 'source.address': '10.0.1.20', 'source.port': 50074, 'source.bytes': 106, 'source.ip': '10.0.1.20', 'source.packets': 1, 'fileset.name': 'ftd', 'tags': ['cisco-ftd', 'forwarded'], 'network.protocol': 'dns', 'network.application': 'dns client', 'network.transport': 'udp', 'network.iana_number': 17, 'input.type': 'log', 'observer.ingress.interface.name': 'outside', 'observer.hostname': 'firepower', 'observer.product': 'ftd', 'observer.vendor': 'Cisco', 'observer.type': 'firewall', 'observer.egress.interface.name': 'inside', '@timestamp': '2019-08-15T14:05:37.000-02:00', 'related.hosts': ['firepower', 'firepower'], 'related.ip': ['10.0.1.20', '8.8.8.8'], 'related.user': ['No Authentication Required'], 'service.type': 'cisco', 'host.hostname': 'firepower', 'event.severity': 1, 'event.code': 430002, 'event.original': '%FTD-1-430002: AccessControlRuleAction: Allow, SrcIP: 10.0.1.20, DstIP: 8.8.8.8, SrcPort: 50074, DstPort: 53, Protocol: udp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, ACPolicy: default, AccessControlRuleName: Rule-1, Prefilter Policy: Default Prefilter Policy, User: No Authentication Required, Client: DNS client, ApplicationProtocol: DNS, InitiatorPackets: 1, ResponderPackets: 0, InitiatorBytes: 106, ResponderBytes: 0, NAPPolicy: Balanced Security and Connectivity, DNSQuery: eu-central-1.ec2.archive.ubuntu.com, DNSRecordType: a host address', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'cisco', 'event.action': 'connection-started', 'event.category': ['network'], 'event.type': ['connection', 'start', 'allowed'], 'event.dataset': 'cisco.ftd', 'event.outcome': 'allow', 'user.name': 'No Authentication Required', 'user.id': 'No Authentication Required', 'cisco.ftd.destination_interface': 'outside', 'cisco.ftd.security.egress_zone': 'output-zone', 'cisco.ftd.security.dns_record_type': 'a host address', 'cisco.ftd.security.responder_packets': '0', 'cisco.ftd.security.access_control_rule_name': 'Rule-1', 'cisco.ftd.security.egress_interface': 'outside', 'cisco.ftd.security.dns_query': 'eu-central-1.ec2.archive.ubuntu.com', 'cisco.ftd.security.access_control_rule_action': 'Allow', 'cisco.ftd.security.prefilter_policy': 'Default Prefilter Policy', 'cisco.ftd.security.nap_policy': 'Balanced Security and Connectivity', 'cisco.ftd.security.ingress_zone': 'input-zone', 'cisco.ftd.security.dst_ip': '8.8.8.8', 'cisco.ftd.security.ac_policy': 'default', 'cisco.ftd.security.src_port': '50074', 'cisco.ftd.security.src_ip': '10.0.1.20', 'cisco.ftd.security.protocol': 'udp', 'cisco.ftd.security.application_protocol': 'DNS', 'cisco.ftd.security.initiator_bytes': '106', 'cisco.ftd.security.initiator_packets': '1', 'cisco.ftd.security.dst_port': '53', 'cisco.ftd.security.ingress_interface': 'inside', 'cisco.ftd.security.client': 'DNS client', 'cisco.ftd.security.responder_bytes': '0', 'cisco.ftd.security.user': 'No Authentication Required', 'cisco.ftd.rule_name': ['default', 'Rule-1'], 'cisco.ftd.source_interface': 'inside', 'cisco.ftd.message_id': '430002'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_015_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 5.806
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 0, 'log.level': 'alert', 'dns.response_code': 'NOERROR', 'dns.question.name': 'elastic.co', 'dns.question.type': 'A', 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 15169, 'destination.as.organization.name': 'Google LLC', 'destination.address': '8.8.8.8', 'destination.port': 53, 'destination.bytes': 145, 'destination.ip': '8.8.8.8', 'destination.packets': 1, 'source.address': '10.0.1.20', 'source.port': 57379, 'source.bytes': 93, 'source.ip': '10.0.1.20', 'source.packets': 1, 'fileset.name': 'ftd', 'tags': ['cisco-ftd', 'forwarded'], 'network.protocol': 'dns', 'network.application': 'dns client', 'network.transport': 'udp', 'network.iana_number': 17, 'input.type': 'log', 'observer.ingress.interface.name': 'outside', 'observer.hostname': 'siem-ftd', 'observer.product': 'ftd', 'observer.vendor': 'Cisco', 'observer.type': 'firewall', 'observer.egress.interface.name': 'inside', '@timestamp': '2019-08-26T21:11:03.000-02:00', 'related.hosts': ['siem-ftd', 'siem-ftd'], 'related.ip': ['10.0.1.20', '8.8.8.8'], 'related.user': ['No Authentication Required'], 'service.type': 'cisco', 'host.hostname': 'siem-ftd', 'event.severity': 1, 'event.code': 430003, 'event.original': '%FTD-1-430003: AccessControlRuleAction: Allow, SrcIP: 10.0.1.20, DstIP: 8.8.8.8, SrcPort: 57379, DstPort: 53, Protocol: udp, IngressInterface: inside, EgressInterface: outside, IngressZone: input-zone, EgressZone: output-zone, ACPolicy: default, AccessControlRuleName: Intrusion-Rule, Prefilter Policy: Default Prefilter Policy, User: No Authentication Required, Client: DNS client, ApplicationProtocol: DNS, ConnectionDuration: 0, InitiatorPackets: 1, ResponderPackets: 1, InitiatorBytes: 93, ResponderBytes: 145, NAPPolicy: Balanced Security and Connectivity, DNSQuery: elastic.co, DNSRecordType: a host address, DNS_TTL: 70', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'cisco', 'event.start': '2019-08-26T23:11:03.000Z', 'event.type': ['connection', 'end', 'allowed'], 'event.duration': 0, 'event.action': 'connection-finished', 'event.end': '2019-08-26T21:11:03.000-02:00', 'event.category': ['network'], 'event.dataset': 'cisco.ftd', 'event.outcome': 'allow', 'user.name': 'No Authentication Required', 'user.id': 'No Authentication Required', 'cisco.ftd.destination_interface': 'outside', 'cisco.ftd.security.egress_zone': 'output-zone', 'cisco.ftd.security.dns_record_type': 'a host address', 'cisco.ftd.security.responder_packets': '1', 'cisco.ftd.security.dns_query': 'elastic.co', 'cisco.ftd.security.access_control_rule_action': 'Allow', 'cisco.ftd.security.nap_policy': 'Balanced Security and Connectivity', 'cisco.ftd.security.dst_ip': '8.8.8.8', 'cisco.ftd.security.ac_policy': 'default', 'cisco.ftd.security.src_ip': '10.0.1.20', 'cisco.ftd.security.protocol': 'udp', 'cisco.ftd.security.application_protocol': 'DNS', 'cisco.ftd.security.initiator_bytes': '93', 'cisco.ftd.security.initiator_packets': '1', 'cisco.ftd.security.connection_duration': '0', 'cisco.ftd.security.client': 'DNS client', 'cisco.ftd.security.access_control_rule_name': 'Intrusion-Rule', 'cisco.ftd.security.egress_interface': 'outside', 'cisco.ftd.security.prefilter_policy': 'Default Prefilter Policy', 'cisco.ftd.security.ingress_zone': 'input-zone', 'cisco.ftd.security.src_port': '57379', 'cisco.ftd.security.dns_ttl': '70', 'cisco.ftd.security.dst_port': '53', 'cisco.ftd.security.ingress_interface': 'inside', 'cisco.ftd.security.responder_bytes': '145', 'cisco.ftd.security.user': 'No Authentication Required', 'cisco.ftd.rule_name': ['default', 'Intrusion-Rule'], 'cisco.ftd.source_interface': 'inside', 'cisco.ftd.message_id': '430003'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_018_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.726
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name'], root['source.geo.country_name']]}, full object: {'log.offset': 0, 'log.level': 'unknown', 'destination.geo.continent_name': 'Europe', 'destination.geo.country_iso_code': 'FR', 'destination.geo.country_name': 'France', 'destination.geo.location.lon': 2.3387, 'destination.geo.location.lat': 48.8582, 'destination.as.number': 3215, 'destination.as.organization.name': 'Orange', 'destination.address': '2.2.2.2', 'destination.port': 80, 'destination.bytes': 246, 'destination.ip': '2.2.2.2', 'destination.packets': 4, 'source.geo.continent_name': 'North America', 'source.geo.region_iso_code': 'US-WA', 'source.geo.city_name': 'Seattle', 'source.geo.country_iso_code': 'US', 'source.geo.country_name': 'United States', 'source.geo.region_name': 'Washington', 'source.geo.location.lon': -122.3451, 'source.geo.location.lat': 47.6348, 'source.address': '3.3.3.3', 'source.port': 65090, 'source.bytes': 729, 'source.ip': '3.3.3.3', 'source.packets': 4, 'network.protocol': 'http', 'network.application': 'chrome', 'network.transport': 'tcp', 'network.iana_number': 6, 'observer.ingress.interface.name': 's1p2', 'observer.hostname': 'CISCO-SENSOR-3D', 'observer.product': 'ftd', 'observer.vendor': 'Cisco', 'observer.type': 'firewall', 'observer.egress.interface.name': 's1p1', 'related.hosts': ['CISCO-SENSOR-3D', 'CISCO-SENSOR-3D'], 'related.ip': ['3.3.3.3', '2.2.2.2'], 'related.user': ['No Authentication Required'], 'host.hostname': 'CISCO-SENSOR-3D', 'event.severity': 0, 'event.code': 430003, 'event.original': '%NGIPS-0-430003: DeviceUUID: 1c8ff662-08f3-11e4-85c0-bc960372972f, AccessControlRuleAction: Allow, AccessControlRuleReason: IP Monitor, SrcIP: 3.3.3.3, DstIP: 2.2.2.2, SrcPort: 65090, DstPort: 80, Protocol: tcp, IngressInterface: s1p1, EgressInterface: s1p2, IngressZone: Inside-DMZ-Interface-Inline, EgressZone: Inside-DMZ-Interface-Inline, ACPolicy: COOL-POLICY-3D, AccessControlRuleName: Inside DMZ-Rule-Inline, Prefilter Policy: Unknown, User: No Authentication Required, UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36, Client: Chrome, ClientVersion: 80.0.3987.87, ApplicationProtocol: HTTP, ConnectionDuration: 20, InitiatorPackets: 4, ResponderPackets: 4, InitiatorBytes: 729, ResponderBytes: 246, NAPPolicy: State-Backbone, SecIntMatchingIP: Destination, IPReputationSICategory: Malware, HTTPReferer: http://eyedropper-color-pick.info/mk?c=1581483445764, ReferencedHost: eyedropper-color-pick.info, URL: http://bad-malwaresite-grr.info/favicon.ico', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'cisco', 'event.start': '2020-03-01T01:02:16.000Z', 'event.type': ['connection', 'end', 'allowed'], 'event.duration': 20000000000, 'event.action': 'connection-finished', 'event.end': '2020-02-29T23:02:36.000-02:00', 'event.category': ['network'], 'event.dataset': 'cisco.ftd', 'event.outcome': 'allow', 'cisco.ftd.destination_interface': 's1p2', 'cisco.ftd.security.access_control_rule_reason': 'IP Monitor', 'cisco.ftd.security.egress_zone': 'Inside-DMZ-Interface-Inline', 'cisco.ftd.security.responder_packets': '4', 'cisco.ftd.security.access_control_rule_action': 'Allow', 'cisco.ftd.security.nap_policy': 'State-Backbone', 'cisco.ftd.security.dst_ip': '2.2.2.2', 'cisco.ftd.security.ac_policy': 'COOL-POLICY-3D', 'cisco.ftd.security.src_ip': '3.3.3.3', 'cisco.ftd.security.protocol': 'tcp', 'cisco.ftd.security.application_protocol': 'HTTP', 'cisco.ftd.security.initiator_bytes': '729', 'cisco.ftd.security.sec_int_matching_ip': 'Destination', 'cisco.ftd.security.initiator_packets': '4', 'cisco.ftd.security.connection_duration': '20', 'cisco.ftd.security.client': 'Chrome', 'cisco.ftd.security.client_version': '80.0.3987.87', 'cisco.ftd.security.referenced_host': 'eyedropper-color-pick.info', 'cisco.ftd.security.user_agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36', 'cisco.ftd.security.access_control_rule_name': 'Inside DMZ-Rule-Inline', 'cisco.ftd.security.egress_interface': 's1p2', 'cisco.ftd.security.prefilter_policy': 'Unknown', 'cisco.ftd.security.ingress_zone': 'Inside-DMZ-Interface-Inline', 'cisco.ftd.security.url': 'http://bad-malwaresite-grr.info/favicon.ico', 'cisco.ftd.security.src_port': '65090', 'cisco.ftd.security.http_referer': 'http://eyedropper-color-pick.info/mk?c=1581483445764', 'cisco.ftd.security.ip_reputation_si_category': 'Malware', 'cisco.ftd.security.dst_port': '80', 'cisco.ftd.security.ingress_interface': 's1p1', 'cisco.ftd.security.responder_bytes': '246', 'cisco.ftd.security.user': 'No Authentication Required', 'cisco.ftd.rule_name': ['COOL-POLICY-3D', 'Inside DMZ-Rule-Inline'], 'cisco.ftd.source_interface': 's1p1', 'cisco.ftd.message_id': '430003', 'user_agent.original': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36', 'process.name': 'Alerts', 'fileset.name': 'ftd', 'url.original': 'http://bad-malwaresite-grr.info/favicon.ico', 'url.domain': 'eyedropper-color-pick.info', 'tags': ['cisco-ftd', 'forwarded'], 'input.type': 'log', '@timestamp': '2020-02-29T23:02:36.000-02:00', 'service.type': 'cisco', 'http.request.referrer': 'http://eyedropper-color-pick.info/mk?c=1581483445764', 'user.name': 'No Authentication Required', 'user.id': 'No Authentication Required'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name'], root['source.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_023_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 5.54
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.original': 'Jun 20 02:41:56 198.51.100.2 1663306: Jun 20 02:41:55.222: %SEC-6-IPACCESSLOGP: list 150 denied tcp 198.51.100.12(59825) -> 172.217.10.46(80), 1 packet', 'log.offset': 1064, 'log.level': 'informational', 'log.source.address': '198.51.100.2', 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 15169, 'destination.as.organization.name': 'Google LLC', 'destination.address': '172.217.10.46', 'destination.port': 80, 'destination.ip': '172.217.10.46', 'source.address': '198.51.100.12', 'source.port': 59825, 'source.ip': '198.51.100.12', 'source.packets': 1, 'fileset.name': 'ios', 'message': 'list 150 denied tcp 198.51.100.12(59825) -> 172.217.10.46(80), 1 packet', 'network.community_id': '1:chQ9+C+0W0ihrzqZ0HbcFSRdBRc=', 'network.transport': 'tcp', 'network.type': 'ipv4', 'network.packets': 1, 'tags': ['cisco-ios', 'forwarded'], 'input.type': 'log', 'related.ip': ['198.51.100.12', '172.217.10.46'], 'service.type': 'cisco', 'event.severity': 6, 'event.sequence': 1663306, 'event.code': 'IPACCESSLOGP', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'cisco', 'event.category': ['network', 'network_traffic'], 'event.type': ['connection', 'firewall'], 'event.dataset': 'cisco.ios', 'event.outcome': 'deny', 'cisco.ios.access_list': '150', 'cisco.ios.facility': 'SEC'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_031_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.401
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'server.address': '35.199.178.4', 'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.region_iso_code': 'US-CA', 'destination.geo.city_name': 'Mountain View', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.region_name': 'California', 'destination.geo.location.lon': -122.0748, 'destination.geo.location.lat': 37.4043, 'destination.as.number': 15169, 'destination.as.organization.name': 'Google LLC', 'destination.address': '35.199.178.4', 'destination.port': 9243, 'destination.ip': '35.199.178.4', 'zeek.session_id': 'CAOvs1BMFCX2Eh0Y3', 'zeek.ssl.cipher': 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'zeek.ssl.established': True, 'zeek.ssl.server.subject.country': 'US', 'zeek.ssl.server.subject.organization': 'Elasticsearch Inc.', 'zeek.ssl.server.subject.locality': 'Mountain View', 'zeek.ssl.server.subject.state': 'California', 'zeek.ssl.server.subject.common_name': '.gcp.cloud.es.io', 'zeek.ssl.server.cert_chain_fuids': ['FebkbHWVCV8rEEEne', 'F4BDY41MGUBT6URZMd', 'FWlfEfiHVkv8evDL3'], 'zeek.ssl.server.name': 'dd625ffb4fc54735b281862aa1cd6cd4.us-west1.gcp.cloud.es.io', 'zeek.ssl.server.issuer.country': 'US', 'zeek.ssl.server.issuer.organization': 'DigiCert Inc', 'zeek.ssl.server.issuer.common_name': 'DigiCert SHA2 Secure Server CA', 'zeek.ssl.curve': 'secp256r1', 'zeek.ssl.resumed': False, 'zeek.ssl.version': 'TLSv12', 'zeek.ssl.validation.status': 'ok', 'source.address': '10.178.98.102', 'source.port': 63199, 'source.ip': '10.178.98.102', 'fileset.name': 'ssl', 'tags': ['zeek.ssl'], 'network.community_id': '1:1PMhYqOKBIyRAQeMbg/pWiJ198g=', 'network.transport': 'tcp', 'input.type': 'log', '@timestamp': '2019-01-17T01:32:16.805Z', 'related.ip': ['10.178.98.102', '35.199.178.4'], 'service.type': 'zeek', 'client.address': '10.178.98.102', 'tls.cipher': 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'tls.established': True, 'tls.server.x509.subject.country': 'US', 'tls.server.x509.subject.state_or_province': 'California', 'tls.server.x509.subject.organization': 'Elasticsearch Inc.', 'tls.server.x509.subject.locality': 'Mountain View', 'tls.server.x509.subject.common_name': '.gcp.cloud.es.io', 'tls.server.x509.issuer.country': 'US', 'tls.server.x509.issuer.organization': 'DigiCert Inc', 'tls.server.x509.issuer.common_name': 'DigiCert SHA2 Secure Server CA', 'tls.server.issuer': 'CN=DigiCert SHA2 Secure Server CA,O=DigiCert Inc,C=US', 'tls.curve': 'secp256r1', 'tls.resumed': False, 'tls.version': '1.2', 'tls.version_protocol': 'tls', 'event.kind': 'event', 'event.module': 'zeek', 'event.id': 'CAOvs1BMFCX2Eh0Y3', 'event.category': ['network'], 'event.type': ['connection', 'protocol'], 'event.dataset': 'zeek.ssl'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_045_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.435
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 23028, 'destination.as.organization.name': 'Team Cymru Inc.', 'destination.address': '38.229.70.20', 'destination.port': 8000, 'destination.ip': '38.229.70.20', 'zeek.session_id': 'CNJBX5FQdL62VUUP1', 'zeek.irc.addl': '+iw xxxxx XxxxxxXxxx ', 'zeek.irc.value': 'xxxxx', 'zeek.irc.command': 'USER', 'source.address': '10.180.156.249', 'source.port': 45921, 'source.ip': '10.180.156.249', 'fileset.name': 'irc', 'network.protocol': 'irc', 'network.community_id': '1:YdkGov/c+KLtmg7Cf5DLDB4+YdQ=', 'network.transport': 'tcp', 'tags': ['zeek.irc'], 'input.type': 'log', '@timestamp': '2013-12-20T15:44:10.647Z', 'related.ip': ['10.180.156.249', '38.229.70.20'], 'service.type': 'zeek', 'event.kind': 'event', 'event.module': 'zeek', 'event.action': 'USER', 'event.id': 'CNJBX5FQdL62VUUP1', 'event.category': ['network'], 'event.type': ['connection', 'protocol', 'info'], 'event.dataset': 'zeek.irc'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_050_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.3
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name'], root['source.geo.country_name']]}, full object: {'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 427, 'destination.as.organization.name': 'Air Force Systems Networking', 'destination.address': '132.16.110.133', 'destination.port': 8080, 'destination.ip': '132.16.110.133', 'zeek.tunnel.action': 'Tunnel::DISCOVER', 'zeek.tunnel.type': 'Tunnel::HTTP', 'source.geo.continent_name': 'North America', 'source.geo.country_iso_code': 'US', 'source.geo.country_name': 'United States', 'source.geo.location.lon': -97.822, 'source.geo.location.lat': 37.751, 'source.as.number': 427, 'source.as.organization.name': 'Air Force Systems Networking', 'source.address': '132.16.146.79', 'source.port': 0, 'source.ip': '132.16.146.79', 'fileset.name': 'tunnel', 'tags': ['zeek.tunnel'], 'input.type': 'log', '@timestamp': '2018-12-10T01:34:26.743Z', 'related.ip': ['132.16.146.79', '132.16.110.133'], 'service.type': 'zeek', 'event.kind': 'event', 'event.module': 'zeek', 'event.action': 'Tunnel::DISCOVER', 'event.type': ['connection'], 'event.category': ['network'], 'event.dataset': 'zeek.tunnel'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name'], root['source.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_052_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.155
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.region_iso_code': 'US-CA', 'destination.geo.city_name': 'San Jose', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.region_name': 'California', 'destination.geo.location.lon': -121.8914, 'destination.geo.location.lat': 37.3388, 'destination.as.number': 6185, 'destination.as.organization.name': 'Apple Inc.', 'destination.address': '17.253.5.203', 'destination.port': 80, 'destination.ip': '17.253.5.203', 'zeek.http.resp_mime_types': ['application/ocsp-response'], 'zeek.http.trans_depth': 1, 'zeek.http.status_msg': 'OK', 'zeek.http.resp_fuids': ['F5zuip1tSwASjNAHy7'], 'zeek.http.tags': [], 'zeek.session_id': 'CCNp8v1SNzY7v9d1Ih', 'source.address': '10.178.98.102', 'source.port': 62995, 'source.ip': '10.178.98.102', 'fileset.name': 'http', 'url.original': '/ocsp04-aaica02/ME4wTKADAgEAMEUwQzBBMAkGBSsOAwIaBQAEFNqvF+Za6oA4ceFRLsAWwEInjUhJBBQx6napI3Sl39T97qDBpp7GEQ4R7AIIUP1IOZZ86ns=', 'url.port': 80, 'url.domain': 'ocsp.apple.com', 'network.community_id': '1:dtBPRfpKEZyg1iOHss95buwv+cw=', 'network.transport': 'tcp', 'tags': ['zeek.http'], 'input.type': 'log', '@timestamp': '2019-01-17T01:05:30.172Z', 'related.ip': ['10.178.98.102', '17.253.5.203'], 'service.type': 'zeek', 'http.request.method': 'GET', 'http.request.body.bytes': 0, 'http.response.status_code': 200, 'http.response.body.bytes': 3735, 'http.version': '1.1', 'event.kind': 'event', 'event.module': 'zeek', 'event.action': 'get', 'event.id': 'CCNp8v1SNzY7v9d1Ih', 'event.category': ['network', 'web'], 'event.type': ['connection', 'info', 'protocol'], 'event.dataset': 'zeek.http', 'event.outcome': 'success', 'user_agent.original': 'com.apple.trustd/2.0', 'user_agent.name': 'Other', 'user_agent.device.name': 'Other'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_054_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.574
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 15169, 'destination.as.organization.name': 'Google LLC', 'destination.address': '8.8.8.8', 'destination.ip': '8.8.8.8', 'source.address': '192.168.1.1', 'source.ip': '192.168.1.1', 'fileset.name': 'traceroute', 'network.transport': 'udp', 'tags': ['zeek.traceroute'], 'input.type': 'log', '@timestamp': '2013-02-26T22:02:38.650Z', 'related.ip': ['192.168.1.1', '8.8.8.8'], 'service.type': 'zeek', 'event.kind': 'event', 'event.module': 'zeek', 'event.category': ['network'], 'event.type': ['info'], 'event.dataset': 'zeek.traceroute'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_060_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.367
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name'], root['source.geo.country_name']]}, full object: {'log.offset': 357, 'destination.geo.continent_name': 'Europe', 'destination.geo.region_iso_code': 'DE-HE', 'destination.geo.city_name': 'Frankfurt am Main', 'destination.geo.country_iso_code': 'DE', 'destination.geo.country_name': 'Germany', 'destination.geo.region_name': 'Hesse', 'destination.geo.location.lon': 8.6843, 'destination.geo.location.lat': 50.1188, 'destination.as.number': 14061, 'destination.as.organization.name': 'DigitalOcean, LLC', 'destination.address': '207.154.238.205', 'destination.ip': '207.154.238.205', 'rule.name': 'Scan::Port_Scan', 'rule.description': '8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s', 'zeek.notice.suppress_for': 3600, 'zeek.notice.msg': '8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s', 'zeek.notice.sub': 'remote', 'zeek.notice.note': 'Scan::Port_Scan', 'zeek.notice.dropped': False, 'zeek.notice.peer_descr': 'bro', 'source.geo.continent_name': 'North America', 'source.geo.region_iso_code': 'US-CO', 'source.geo.city_name': 'Longmont', 'source.geo.country_iso_code': 'US', 'source.geo.country_name': 'United States', 'source.geo.region_name': 'Colorado', 'source.geo.location.lon': -105.1624, 'source.geo.location.lat': 40.1559, 'source.as.number': 393552, 'source.as.organization.name': 'Longmont Power & Communications', 'source.address': '8.42.77.171', 'source.ip': '8.42.77.171', 'fileset.name': 'notice', 'tags': ['zeek.notice'], 'input.type': 'log', '@timestamp': '2019-02-28T22:36:28.426Z', 'related.ip': ['8.42.77.171', '207.154.238.205'], 'service.type': 'zeek', 'event.kind': 'alert', 'event.module': 'zeek', 'event.type': ['info', 'allowed'], 'event.category': ['intrusion_detection'], 'event.dataset': 'zeek.notice'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name'], root['source.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_061_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.778
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 398, 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 15169, 'destination.as.organization.name': 'Google LLC', 'destination.address': '8.8.8.8', 'destination.port': 53, 'destination.bytes': 206, 'destination.ip': '8.8.8.8', 'destination.packets': 1, 'zeek.session_id': 'CAcJw21BbVedgFnYH4', 'zeek.connection.local_resp': False, 'zeek.connection.local_orig': True, 'zeek.connection.state': 'SF', 'zeek.connection.history': 'Dd', 'zeek.connection.missed_bytes': 0, 'zeek.connection.state_message': 'Normal establishment and termination.', 'source.address': '192.168.86.167', 'source.port': 38340, 'source.bytes': 103, 'source.ip': '192.168.86.167', 'source.packets': 1, 'fileset.name': 'connection', 'network.protocol': 'dns', 'network.community_id': '1:77KJyeznYjdDxCSKdZhW89aAaBI=', 'network.bytes': 309, 'network.transport': 'udp', 'network.packets': 2, 'network.direction': 'outbound', 'tags': ['zeek.connection', 'local_orig'], 'input.type': 'log', '@timestamp': '2019-01-11T06:33:36.857Z', 'related.ip': ['192.168.86.167', '8.8.8.8'], 'service.type': 'zeek', 'event.duration': 76967000, 'event.kind': 'event', 'event.module': 'zeek', 'event.id': 'CAcJw21BbVedgFnYH4', 'event.category': ['network'], 'event.type': ['connection', 'start', 'end'], 'event.dataset': 'zeek.connection'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_063_zeek – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.43
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 29791, 'destination.as.organization.name': 'Internap Corporation', 'destination.address': '74.63.41.218', 'destination.port': 5060, 'destination.ip': '74.63.41.218', 'zeek.session_id': 'CPRLCB4eWHdjP852Bk', 'zeek.sip.sequence.number': '4127', 'zeek.sip.sequence.method': 'REGISTER', 'zeek.sip.request.path': ['SIP/2.0/UDP 172.16.133.19:5060'], 'zeek.sip.request.from': '"AppNeta" sip:116954_Boston6@newyork.voip.ms', 'zeek.sip.request.to': 'sip:116954_Boston6@newyork.voip.ms', 'zeek.sip.request.body_length': 0, 'zeek.sip.response.path': ['SIP/2.0/UDP 172.16.133.19:5060'], 'zeek.sip.response.from': '"AppNeta" sip:116954_Boston6@newyork.voip.ms', 'zeek.sip.response.to': 'sip:116954_Boston6@newyork.voip.ms;tag=as023f66a5', 'zeek.sip.response.body_length': 0, 'zeek.sip.uri': 'sip:newyork.voip.ms:5060', 'zeek.sip.transaction_depth': 0, 'zeek.sip.user_agent': 'PolycomSoundStationIP-SSIP_5000-UA/3.2.4.0267', 'zeek.sip.call_id': '8694cd7e-976e4fc3-d76f6e38@172.16.133.19', 'zeek.sip.status.msg': 'Unauthorized', 'zeek.sip.status.code': 401, 'source.address': '172.16.133.19', 'source.port': 5060, 'source.ip': '172.16.133.19', 'fileset.name': 'sip', 'url.full': 'sip:newyork.voip.ms:5060', 'tags': ['zeek.sip'], 'network.community_id': '1:t8Jl0amIXPHemzxKgsLjtkB+ewo=', 'network.protocol': 'sip', 'network.transport': 'udp', 'input.type': 'log', '@timestamp': '2013-02-26T22:02:39.055Z', 'related.ip': ['172.16.133.19', '74.63.41.218'], 'service.type': 'zeek', 'event.kind': 'event', 'event.module': 'zeek', 'event.action': 'REGISTER', 'event.id': 'CPRLCB4eWHdjP852Bk', 'event.type': ['connection', 'protocol', 'error'], 'event.category': ['network'], 'event.dataset': 'zeek.sip', 'event.outcome': 'failure'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_066_okta – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.762
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['source.geo.country_name']]}, full object: {'log.offset': 0, 'source.geo.continent_name': 'North America', 'source.geo.region_iso_code': 'US-CA', 'source.geo.city_name': 'Dublin', 'source.geo.country_iso_code': 'US', 'source.geo.country_name': 'United States', 'source.geo.region_name': 'California', 'source.geo.location.lon': -121.919, 'source.geo.location.lat': 37.7201, 'source.as.number': 7018, 'source.as.organization.name': 'AT&T Services, Inc.', 'source.ip': '108.255.197.247', 'source.user.full_name': 'xxxxxx', 'source.user.id': '00u1abvz4pYqdM8ms4x6', 'fileset.name': 'system', 'tags': ['forwarded'], 'input.type': 'log', '@timestamp': '2020-02-14T22:18:51.843Z', 'related.ip': '108.255.197.247', 'related.user': 'xxxxxx', 'service.type': 'okta', 'client.geo.city_name': 'Dublin', 'client.geo.country_name': 'United States', 'client.geo.region_name': 'California', 'client.geo.location.lon': -121.919, 'client.geo.location.lat': 37.7201, 'client.ip': '108.255.197.247', 'client.user.full_name': 'xxxxxx', 'client.user.id': '00u1abvz4pYqdM8ms4x6', 'event.original': '{"actor":{"alternateId":"xxxxxx@elastic.co","detailEntry":null,"displayName":"xxxxxx","id":"00u1abvz4pYqdM8ms4x6","type":"User"},"authenticationContext":{"authenticationProvider":null,"authenticationStep":0,"credentialProvider":null,"credentialType":null,"externalSessionId":"102nZHzd6OHSfGG51vsoc22gw","interface":null,"issuer":null},"client":{"device":"Computer","geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"id":null,"ipAddress":"108.255.197.247","userAgent":{"browser":"FIREFOX","os":"Mac OS X","rawUserAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0"},"zone":"null"},"debugContext":{"debugData":{"authnRequestId":"XkcAsWb8WjwDP76xh@1v8wAABp0","requestId":"XkccyyMli2Uay2I93ZgRzQAAB0c","requestUri":"/login/signout","threatSuspected":"false","url":"/login/signout?message=login_page_messages.session_has_expired"}},"displayMessage":"User logout from Okta","eventType":"user.session.end","legacyEventType":"core.user_auth.logout_success","outcome":{"reason":null,"result":"SUCCESS"},"published":"2020-02-14T22:18:51.843Z","request":{"ipChain":[{"geographicalContext":{"city":"Dublin","country":"United States","geolocation":{"lat":37.7201,"lon":-121.919},"postalCode":"94568","state":"California"},"ip":"108.255.197.247","source":null,"version":"V4"}]},"securityContext":{"asNumber":null,"asOrg":null,"domain":null,"isProxy":null,"isp":null},"severity":"INFO","target":null,"transaction":{"detail":{},"id":"XkccyyMli2Uay2I93ZgRzQAAB0c","type":"WEB"},"uuid":"faf7398a-4f77-11ea-97fb-5925e98228bd","version":"0"}', 'event.kind': 'event', 'event.module': 'okta', 'event.action': 'user.session.end', 'event.id': 'faf7398a-4f77-11ea-97fb-5925e98228bd', 'event.category': ['authentication'], 'event.type': ['access'], 'event.dataset': 'okta.system', 'event.outcome': 'success', 'okta.actor.id': '00u1abvz4pYqdM8ms4x6', 'okta.actor.type': 'User', 'okta.actor.display_name': 'xxxxxx', 'okta.actor.alternate_id': 'xxxxxx@elastic.co', 'okta.debug_context.debug_data.threat_suspected': 'false', 'okta.debug_context.debug_data.request_id': 'XkccyyMli2Uay2I93ZgRzQAAB0c', 'okta.debug_context.debug_data.request_uri': '/login/signout', 'okta.debug_context.debug_data.url': '/login/signout?message=login_page_messages.session_has_expired', 'okta.event_type': 'user.session.end', 'okta.authentication_context.authentication_step': 0, 'okta.authentication_context.external_session_id': '102nZHzd6OHSfGG51vsoc22gw', 'okta.display_message': 'User logout from Okta', 'okta.client.zone': 'null', 'okta.client.ip': '108.255.197.247', 'okta.client.device': 'Computer', 'okta.client.user_agent.raw_user_agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0', 'okta.client.user_agent.os': 'Mac OS X', 'okta.client.user_agent.browser': 'FIREFOX', 'okta.uuid': 'faf7398a-4f77-11ea-97fb-5925e98228bd', 'okta.transaction.id': 'XkccyyMli2Uay2I93ZgRzQAAB0c', 'okta.transaction.type': 'WEB', 'okta.outcome.result': 'SUCCESS', 'user_agent.original': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0', 'user_agent.os.name': 'Mac OS X', 'user_agent.os.version': '10.15', 'user_agent.os.full': 'Mac OS X 10.15', 'user_agent.name': 'Firefox', 'user_agent.device.name': 'Mac', 'user_agent.version': '72.0.'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['source.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_069_iptables – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.223
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['source.geo.country_name']]}, full object: {'iptables.tcp.reserved_bits': 0, 'iptables.tcp.flags': ['ACK'], 'iptables.tcp.window': 2853, 'iptables.input_device': 'eth0', 'iptables.precedence_bits': 0, 'iptables.fragment_flags': ['DF'], 'iptables.length': 52, 'iptables.ttl': 63, 'iptables.ubiquiti.output_zone': 'lan', 'iptables.ubiquiti.input_zone': 'wan', 'iptables.ubiquiti.rule_set': 'wan-lan', 'iptables.ubiquiti.rule_number': 'default', 'iptables.ether_type': 2048, 'iptables.tos': 0, 'iptables.output_device': '', 'iptables.id': 0, 'log.original': 'Oct 10 07:25:12 Hostname kernel: [wan-lan-default-D]IN=eth0 OUT= MAC=90:10:20:76:8d:20:90:10:65:29:b6:2a:08:00 SRC=158.109.0.1 DST=10.4.0.5 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=38842 DPT=443 WINDOW=2853 RES=0x00 ACK URGP=0 ', 'log.offset': 0, 'destination.port': 443, 'destination.ip': '10.4.0.5', 'destination.mac': '90:10:20:76:8d:20', 'rule.name': 'wan-lan', 'rule.id': 'default', 'source.geo.continent_name': 'Europe', 'source.geo.country_iso_code': 'ES', 'source.geo.country_name': 'Spain', 'source.geo.location.lon': -3.684, 'source.geo.location.lat': 40.4172, 'source.as.number': 13041, 'source.as.organization.name': 'Consorci de Serveis Universitaris de Catalunya', 'source.port': 38842, 'source.ip': '158.109.0.1', 'source.mac': '90:10:65:29:b6:2a', 'fileset.name': 'log', 'network.community_id': '1:RGJPRWtru8Lg2itNyFREDvoRkNA=', 'network.transport': 'tcp', 'network.type': 'ipv4', 'tags': ['iptables'], 'input.type': 'log', 'observer.ingress.zone': 'wan', 'observer.egress.zone': 'lan', 'related.ip': ['158.109.0.1', '10.4.0.5'], 'service.type': 'iptables', 'event.timezone': '-02:00', 'event.kind': 'event', 'event.module': 'iptables', 'event.action': 'drop', 'event.type': ['denied', 'connection'], 'event.category': ['network'], 'event.dataset': 'iptables.log'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['source.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_076_cef – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.847
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'log.offset': 0, 'cef.severity': 'Unknown', 'cef.extensions.destinationPort': 443, 'cef.extensions.nat_addtnl_rulenum': '1', 'cef.extensions.sourcePort': 49363, 'cef.extensions.destinationAddress': '52.173.84.157', 'cef.extensions.origin': '192.168.101.254', 'cef.extensions.rule_uid': '9e5e6e74-aa9a-4693-b9fe-53712dd27bea', 'cef.extensions.deviceReceiptTime': '2018-11-26T22:17:32.000Z', 'cef.extensions.layer_uuid': 'b406b732-2437-4848-9741-6eae1f5bf112', 'cef.extensions.deviceCustomDate2Label': 'This field is made up', 'cef.extensions.destinationTranslatedPort': 0, 'cef.extensions.deviceCustomString5Label': 'Matched Category', 'cef.extensions.loguid': '{0x5bfc70fc,0x1,0xfe65a8c0,0xc0000001}', 'cef.extensions.ifname': 'eth0', 'cef.extensions.nat_rulenum': '4', 'cef.extensions.transportProtocol': '6', 'cef.extensions.service_id': 'https', 'cef.extensions.layer_name': 'Network', 'cef.extensions.deviceCustomString2Label': 'Rule Name', 'cef.extensions.product': 'VPN-1 & FireWall-1', 'cef.extensions.sourceAddress': '192.168.101.100', 'cef.extensions.rule_action': 'Accept', 'cef.extensions.sequencenum': '1', 'cef.extensions.deviceAction': 'Accept', 'cef.extensions.inzone': 'Internal', 'cef.extensions.sourceTranslatedPort': 35398, 'cef.extensions.match_id': '4', 'cef.extensions.deviceCustomDate2': '2017-10-16T10:42:13.713Z', 'cef.extensions.originsicname': 'CN=R80,O=R80_M..6u6bdo', 'cef.extensions.deviceCustomString5': 'Business / Economy', 'cef.extensions.outzone': 'External', 'cef.extensions.version': '5', 'cef.extensions.sourceTranslatedAddress': '192.168.103.254', 'cef.extensions.parent_rule': '0', 'cef.extensions.destinationTranslatedAddress': '0.0.0.0', 'cef.extensions.logid': '0', 'cef.extensions.deviceDirection': 0, 'cef.name': 'https', 'cef.version': '0', 'cef.device.product': 'VPN-1 & FireWall-1', 'cef.device.event_class_id': 'Log', 'cef.device.vendor': 'Check Point', 'cef.device.version': 'Check Point', 'destination.nat.port': 0, 'destination.nat.ip': '0.0.0.0', 'destination.geo.continent_name': 'North America', 'destination.geo.region_iso_code': 'US-IA', 'destination.geo.city_name': 'Des Moines', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.region_name': 'Iowa', 'destination.geo.location.lon': -93.6112, 'destination.geo.location.lat': 41.6006, 'destination.as.number': 8075, 'destination.as.organization.name': 'Microsoft Corporation', 'destination.port': 443, 'destination.ip': '52.173.84.157', 'rule.category': 'Business / Economy', 'rule.uuid': '9e5e6e74-aa9a-4693-b9fe-53712dd27bea', 'source.nat.port': 35398, 'source.nat.ip': '192.168.103.254', 'source.port': 49363, 'source.ip': '192.168.101.100', 'message': 'https', 'fileset.name': 'log', 'tags': ['cef', 'forwarded'], 'network.community_id': '1:yRLApDaheTmJZHL4UUDMjcHWAik=', 'network.transport': '6', 'network.direction': 'inbound', 'input.type': 'log', 'observer.ingress.zone': 'Internal', 'observer.ingress.interface.name': 'eth0', 'observer.product': 'VPN-1 & FireWall-1', 'observer.vendor': 'Check Point', 'observer.version': 'Check Point', 'observer.egress.zone': 'External', 'related.ip': ['52.173.84.157', '0.0.0.0', '192.168.101.100', '192.168.103.254'], 'service.type': 'cef', 'event.original': 'CEF:0|Check Point|VPN-1 & FireWall-1|Check Point|Log|https|Unknown|act=Accept destinationTranslatedAddress=0.0.0.0 destinationTranslatedPort=0 deviceDirection=0 rt=1543270652000 sourceTranslatedAddress=192.168.103.254 sourceTranslatedPort=35398 spt=49363 dpt=443 cs2Label=Rule Name layer_name=Network layer_uuid=b406b732-2437-4848-9741-6eae1f5bf112 match_id=4 parent_rule=0 rule_action=Accept rule_uid=9e5e6e74-aa9a-4693-b9fe-53712dd27bea ifname=eth0 logid=0 loguid={0x5bfc70fc,0x1,0xfe65a8c0,0xc0000001} origin=192.168.101.254 originsicname=CN\=R80,O\=R80_M..6u6bdo sequencenum=1 version=5 dst=52.173.84.157 inzone=Internal nat_addtnl_rulenum=1 nat_rulenum=4 outzone=External product=VPN-1 & FireWall-1 proto=6 service_id=https src=192.168.101.100 cs5Label=Matched Category cs5=Business / Economy deviceCustomDate2=1508150533713 deviceCustomDate2Label=This field is made up', 'event.code': 'Log', 'event.kind': 'event', 'event.module': 'cef', 'event.action': 'Accept', 'event.category': 'network', 'event.dataset': 'cef.log'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_078_cef – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 3.518
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['source.geo.country_name']]}, full object: {'cef.severity': 'low', 'cef.extensions.destinationPort': 443, 'cef.extensions.eventId': 3457, 'cef.extensions.sourcePort': 33876, 'cef.extensions.destinationAddress': '192.168.10.1', 'cef.extensions.sourceAddress': '6.7.8.9', 'cef.extensions.sourceServiceName': 'httpd', 'cef.extensions.requestContext': 'https://www.google.com', 'cef.extensions.requestUrl': 'https://www.example.com/cart', 'cef.extensions.sourceGeoLatitude': 38.915, 'cef.extensions.sourceGeoLongitude': -77.511, 'cef.extensions.transportProtocol': 'TCP', 'cef.extensions.requestMethod': 'POST', 'cef.name': 'Web request', 'cef.version': '0', 'cef.device.product': 'Vaporware', 'cef.device.event_class_id': '18', 'cef.device.vendor': 'Elastic', 'cef.device.version': '1.0.0-alpha', 'log.offset': 0, 'destination.port': 443, 'destination.ip': '192.168.10.1', 'source.geo.continent_name': 'North America', 'source.geo.country_iso_code': 'US', 'source.geo.country_name': 'United States', 'source.geo.location.lon': -97.822, 'source.geo.location.lat': 37.751, 'source.port': 33876, 'source.service.name': 'httpd', 'source.ip': '6.7.8.9', 'fileset.name': 'log', 'message': 'Web request', 'url.original': 'https://www.example.com/cart', 'network.community_id': '1:e2rSLr3fJ93cIJDMtVABFxSH5zg=', 'network.transport': 'tcp', 'tags': ['cef', 'forwarded'], 'observer.product': 'Vaporware', 'observer.vendor': 'Elastic', 'observer.version': '1.0.0-alpha', 'input.type': 'log', 'related.ip': ['192.168.10.1', '6.7.8.9'], 'service.type': 'cef', 'http.request.referrer': 'https://www.google.com', 'http.request.method': 'POST', 'event.severity': 0, 'event.code': '18', 'event.original': 'CEF:0|Elastic|Vaporware|1.0.0-alpha|18|Web request|low|eventId=3457 requestMethod=POST slat=38.915 slong=-77.511 proto=TCP sourceServiceName=httpd requestContext=https://www.google.com src=6.7.8.9 spt=33876 dst=192.168.10.1 dpt=443 request=https://www.example.com/cart', 'event.module': 'cef', 'event.id': 3457, 'event.dataset': 'cef.log'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['source.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_083_squid – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 9.911
- Error Details: AssertionError: The following expected object doesn't match: Diff: {'dictionary_item_added': [root['destination.geo.country_name']]}, full object: {'server.domain': 'login.yahoo.com', 'rsa.internal.messageid': 'CONNECT', 'rsa.internal.hcode': 'DIRECT', 'rsa.web.alias_host': 'login.yahoo.com', 'rsa.investigations.ec_subject': 'NetworkComm', 'rsa.investigations.ec_theme': 'ALM', 'rsa.time.event_time_str': '1157689312', 'rsa.time.duration_time': 5006, 'rsa.time.event_time': '2006-09-08T04:21:52.000Z', 'rsa.network.domain': 'login.yahoo.com', 'rsa.misc.content_type': '-', 'rsa.misc.action': ['TCP_MISS', 'CONNECT'], 'rsa.misc.result_code': '200', 'log.offset': 0, 'destination.geo.continent_name': 'North America', 'destination.geo.country_iso_code': 'US', 'destination.geo.country_name': 'United States', 'destination.geo.location.lon': -97.822, 'destination.geo.location.lat': 37.751, 'destination.as.number': 36752, 'destination.as.organization.name': 'Oath Holdings Inc.', 'destination.ip': ['209.73.177.115'], 'source.bytes': 19763, 'source.ip': ['10.105.21.199'], 'fileset.name': 'log', 'url.original': 'login.yahoo.com:443', 'url.domain': 'login.yahoo.com', 'tags': ['squid.log', 'forwarded'], 'input.type': 'log', 'observer.product': 'Proxy', 'observer.vendor': 'Squid', 'observer.type': 'Proxies', '@timestamp': '2006-09-08T04:21:52.000Z', 'related.hosts': ['login.yahoo.com', 'login.yahoo.com'], 'related.ip': ['209.73.177.115', '10.105.21.199'], 'related.user': ['badeyek'], 'service.type': 'squid', 'event.code': 'CONNECT', 'event.original': '1157689312.049 5006 10.105.21.199 TCP_MISS/200 19763 CONNECT login.yahoo.com:443 badeyek DIRECT/209.73.177.115 -', 'event.module': 'squid', 'event.action': 'TCP_MISS', 'event.dataset': 'squid.log', 'user.name': 'badeyek'} assert 1 == 0 + where 1 = len({'dictionary_item_added': [root['destination.geo.country_name']]})
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_084_cyberark – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 90.003
- Error Details: Failed: Timeout >90.0s
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_085_coredns – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.162
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_086_coredns – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.162
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_087_zscaler – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.163
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_088_zscaler – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.148
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_089_sonicwall – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.143
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_090_sonicwall – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.138
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_091_juniper – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.144
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_092_juniper – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.177
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_093_juniper – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.161
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_094_juniper – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.148
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_095_juniper – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.143
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_096_juniper – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.135
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_097_juniper – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.14
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_098_barracuda – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.133
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_099_barracuda – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.212
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_100_fortinet – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.183
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_101_fortinet – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.129
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_102_fortinet – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.125
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_103_fortinet – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.128
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_104_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.144
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_105_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.136
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_106_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.136
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_107_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.222
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_108_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.145
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_109_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.138
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_110_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.13
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_111_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.124
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_112_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.221
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_113_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.224
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_114_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.148
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_115_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.181
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_116_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.229
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_117_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.224
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_118_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.225
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_119_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.129
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_120_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.225
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_121_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.22
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_122_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.224
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_123_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.222
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_124_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.226
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_125_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.226
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_126_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.22
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_127_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.215
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_128_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.219
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_129_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.224
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_130_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.234
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_131_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.229
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_132_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.222
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_133_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.144
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_134_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.215
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_135_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.131
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_136_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.223
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_137_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.225
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_138_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.232
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_139_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.22
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_140_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.232
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_141_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.216
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_142_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.21
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_143_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.223
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_144_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.212
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_145_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.218
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_146_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.224
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_147_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.24
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_148_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.284
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_149_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.258
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_150_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.304
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_151_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.257
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_152_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.224
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_153_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.239
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_154_aws – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.221
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_155_crowdstrike – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.227
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_156_crowdstrike – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.217
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_157_crowdstrike – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.235
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_158_checkpoint – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.232
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_159_checkpoint – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.227
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_160_tomcat – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
- Age: 1
- Duration: 10.241
- Error Details: beat.beat.TimeoutError: Timeout waiting for 'cond' to be true. Waited 10 seconds.

Steps errors

Expand to view the steps failures

Name: mage build test
- Description: mage build test
- Duration: 50 min 23 sec
- Start Time: 2020-10-07T14:54:33.646+0000
- log

Log output

Expand to view the last 100 lines of log output

[2020-10-07T15:44:58.223Z] Status: Downloaded newer image for alpine:3.4
[2020-10-07T15:45:00.459Z] + python .ci/scripts/pre_archive_test.py
[2020-10-07T15:45:02.374Z] Copy ./x-pack/filebeat/build into build/x-pack/filebeat/build
[2020-10-07T15:45:02.396Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-21636/src/github.com/elastic/beats/build
[2020-10-07T15:45:02.747Z] + rm -rf ve
[2020-10-07T15:45:02.747Z] + find . -type d -name vendor -exec rm -r {} ;
[2020-10-07T15:45:02.772Z] WARNING: Unknown parameter(s) found for class type 'hudson.tasks.junit.pipeline.JUnitResultsStep': id,stashedTestReports
[2020-10-07T15:45:02.775Z] Recording test results
[2020-10-07T15:45:04.705Z] Stashed 4 file(s)
[2020-10-07T15:45:05.052Z] + tar --version
[2020-10-07T15:45:05.452Z] + tar --exclude=test-build-artifacts-x-pack/filebeat-build.tgz -czf test-build-artifacts-x-pack/filebeat-build.tgz .
[2020-10-07T15:46:01.992Z] Archiving artifacts
[2020-10-07T15:46:34.012Z] + python .ci/scripts/search_system_tests.py
[2020-10-07T15:46:34.038Z] [INFO] system-tests='build/x-pack/filebeat/build/system-tests'. If no empty then let's create a tarball
[2020-10-07T15:46:34.383Z] + tar --version
[2020-10-07T15:46:34.737Z] + tar --exclude=x-pack-filebeat--system-tests-linux.tgz -czf x-pack-filebeat--system-tests-linux.tgz build/x-pack/filebeat/build/system-tests
[2020-10-07T15:47:01.365Z] Archiving artifacts
[2020-10-07T15:47:13.202Z] Client: Docker Engine - Community
[2020-10-07T15:47:13.202Z]  Version:           19.03.13
[2020-10-07T15:47:13.202Z]  API version:       1.40
[2020-10-07T15:47:13.202Z]  Go version:        go1.13.15
[2020-10-07T15:47:13.202Z]  Git commit:        4484c46d9d
[2020-10-07T15:47:13.202Z]  Built:             Wed Sep 16 17:02:36 2020
[2020-10-07T15:47:13.202Z]  OS/Arch:           linux/amd64
[2020-10-07T15:47:13.202Z]  Experimental:      false
[2020-10-07T15:47:13.202Z] 
[2020-10-07T15:47:13.202Z] Server: Docker Engine - Community
[2020-10-07T15:47:13.202Z]  Engine:
[2020-10-07T15:47:13.202Z]   Version:          19.03.13
[2020-10-07T15:47:13.202Z]   API version:      1.40 (minimum version 1.12)
[2020-10-07T15:47:13.202Z]   Go version:       go1.13.15
[2020-10-07T15:47:13.202Z]   Git commit:       4484c46d9d
[2020-10-07T15:47:13.202Z]   Built:            Wed Sep 16 17:01:06 2020
[2020-10-07T15:47:13.202Z]   OS/Arch:          linux/amd64
[2020-10-07T15:47:13.202Z]   Experimental:     false
[2020-10-07T15:47:13.202Z]  containerd:
[2020-10-07T15:47:13.202Z]   Version:          1.3.7
[2020-10-07T15:47:13.202Z]   GitCommit:        8fba4e9a7d01810a393d5d25a3621dc101981175
[2020-10-07T15:47:13.202Z]  runc:
[2020-10-07T15:47:13.202Z]   Version:          1.0.0-rc10
[2020-10-07T15:47:13.202Z]   GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
[2020-10-07T15:47:13.202Z]  docker-init:
[2020-10-07T15:47:13.202Z]   Version:          0.18.0
[2020-10-07T15:47:13.202Z]   GitCommit:        fec3683
[2020-10-07T15:47:19.366Z] Failed in branch x-pack/filebeat-build
[2020-10-07T15:47:24.599Z] [INFO] unstashV2: JOB_GCS_BUCKET is set. bucket param got precedency instead.
[2020-10-07T15:47:24.756Z] [INFO] unstashV2: JOB_GCS_CREDENTIALS is set. credentialsId param got precedency instead.
[2020-10-07T15:47:24.868Z] [Google Cloud Storage Plugin] Found 1 files to download from pattern: gs://beats-ci-temp/Beats/beats/PR-21636-1/source/source.tgz
[2020-10-07T15:47:24.886Z] [Google Cloud Storage Plugin] Downloading: Beats/beats/PR-21636-1/source/source.tgz to local path: /var/lib/jenkins/workspace/Beats_beats_PR-21636/source.tgz
[2020-10-07T15:47:37.515Z] + tar --version
[2020-10-07T15:47:37.855Z] + tar -xpf source.tgz
[2020-10-07T15:47:48.207Z] + rm source.tgz
[2020-10-07T15:47:48.324Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-21636/src/github.com/elastic/beats
[2020-10-07T15:47:48.359Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-21636/src/github.com/elastic/beats/lint-1602082081608
[2020-10-07T15:47:48.479Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-21636/src/github.com/elastic/beats/x-pack-filebeat-windows-windows-2019-1602083187958
[2020-10-07T15:47:48.601Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-21636/src/github.com/elastic/beats/x-pack-filebeat-build-1602085504279
[2020-10-07T15:47:49.066Z] + cat
[2020-10-07T15:47:49.066Z] + /usr/local/bin/runbld ./runbld-test-reports --job-name elastic+beats+pull-request
[2020-10-07T15:47:49.066Z] Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=UTF8
[2020-10-07T15:47:55.650Z] runbld>>> runbld started
[2020-10-07T15:47:55.650Z] runbld>>> 1.6.12/f45d832f2ba0aa2722ab4ec1fda8ad140f027f8b
[2020-10-07T15:47:56.603Z] runbld>>> The following profiles matched the job 'elastic+beats+pull-request' in order of occurrence in the config (last value wins).
[2020-10-07T15:47:56.864Z] runbld>>> Matches in the system config:
[2020-10-07T15:47:56.864Z] runbld>>> - Matched ^elastic\+beats
[2020-10-07T15:47:56.864Z] runbld>>> - Matched ^elastic\+beats\+pull-request
[2020-10-07T15:47:58.251Z] runbld>>> Debug logging enabled.
[2020-10-07T15:47:58.251Z] runbld>>> Storing result
[2020-10-07T15:47:58.251Z] runbld>>> Store result: created {:total 2, :successful 2, :failed 0} 1
[2020-10-07T15:47:58.251Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1597739501209/t/20201007154757-84A34EC7
[2020-10-07T15:47:58.251Z] runbld>>> Adding system facts.
[2020-10-07T15:47:59.207Z] runbld>>> Adding vcs info for the latest commit:  8b45fd535738c50527068c004fe8803694ef44ca
[2020-10-07T15:47:59.207Z] runbld>>> >>>>>>>>>>>> SCRIPT EXECUTION BEGIN >>>>>>>>>>>>
[2020-10-07T15:47:59.207Z] runbld>>> Adding /usr/lib/jvm/java-8-openjdk-amd64/bin to the path.
[2020-10-07T15:47:59.473Z] + echo 'Processing JUnit reports with runbld...'
[2020-10-07T15:47:59.473Z] Processing JUnit reports with runbld...
[2020-10-07T15:47:59.741Z] runbld>>> <<<<<<<<<<<< SCRIPT EXECUTION END <<<<<<<<<<<<
[2020-10-07T15:47:59.741Z] runbld>>> DURATION: 19ms
[2020-10-07T15:47:59.741Z] runbld>>> STDOUT: 40 bytes
[2020-10-07T15:47:59.741Z] runbld>>> STDERR: 49 bytes
[2020-10-07T15:47:59.741Z] runbld>>> WRAPPED PROCESS: SUCCESS (0)
[2020-10-07T15:47:59.741Z] runbld>>> Searching for build metadata in /var/lib/jenkins/workspace/Beats_beats_PR-21636
[2020-10-07T15:48:00.682Z] runbld>>> Storing build metadata: 
[2020-10-07T15:48:00.682Z] runbld>>> Adding test report.
[2020-10-07T15:48:00.682Z] runbld>>> Searching for junit test output files with the pattern: TEST-.*\.xml$ in: /var/lib/jenkins/workspace/Beats_beats_PR-21636/src/github.com/elastic/beats
[2020-10-07T15:48:01.632Z] runbld>>> Found 6 test output files
[2020-10-07T15:48:02.573Z] runbld>>> Test output logs contained: Errors: 0 Failures: 182 Tests: 2206 Skipped: 244
[2020-10-07T15:48:02.573Z] runbld>>> Storing result
[2020-10-07T15:48:02.573Z] runbld>>> FAILURES: 182
[2020-10-07T15:48:41.325Z] runbld>>> Store result: updated {:total 2, :successful 2, :failed 0} 2
[2020-10-07T15:48:41.325Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1597739501209/t/20201007154757-84A34EC7
[2020-10-07T15:48:41.325Z] runbld>>> Email notification disabled by environment variable.
[2020-10-07T15:48:41.325Z] runbld>>> Slack notification disabled by environment variable.
[2020-10-07T15:48:42.228Z] Running on worker-1244230 in /var/lib/jenkins/workspace/Beats_beats_PR-21636
[2020-10-07T15:48:42.346Z] [INFO] getVaultSecret: Getting secrets
[2020-10-07T15:48:42.408Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2020-10-07T15:48:44.528Z] + chmod 755 generate-build-data.sh
[2020-10-07T15:48:44.528Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-21636/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-21636/runs/1 FAILURE 4979669
[2020-10-07T15:48:44.528Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-21636/runs/1/steps/?limit=10000 -o steps-info.json
[2020-10-07T15:48:46.789Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-21636/runs/1/tests/?status=FAILED -o tests-errors.json
[2020-10-07T15:48:48.239Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-21636/runs/1/log/ -o pipeline-log.txt

[Filebeat S3] Change log.file.path to be nested object (#21624)

8b45fd5

(cherry picked from commit 030077c)

kaiyan-sheng added [zube]: In Review backport Team:Platforms Label for the Integrations - Platforms team labels Oct 7, 2020

botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Oct 7, 2020

kaiyan-sheng self-assigned this Oct 7, 2020

ChrsMark approved these changes Oct 7, 2020

View reviewed changes

kaiyan-sheng merged commit 20cd0af into elastic:7.x Oct 7, 2020

kaiyan-sheng deleted the backport_21624_7.x branch October 7, 2020 16:14

zube bot added [zube]: Done and removed [zube]: In Review labels Oct 7, 2020

zube bot removed the [zube]: Done label Jan 6, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cherry-pick #21624 to 7.x: [Filebeat S3] Change log.file.path to be nested object #21636

Cherry-pick #21624 to 7.x: [Filebeat S3] Change log.file.path to be nested object #21636

kaiyan-sheng commented Oct 7, 2020 •

edited by zube bot

Loading

elasticmachine commented Oct 7, 2020

elasticmachine commented Oct 7, 2020

Build stats

Test stats 🧪

Cherry-pick #21624 to 7.x: [Filebeat S3] Change log.file.path to be nested object #21636

Cherry-pick #21624 to 7.x: [Filebeat S3] Change log.file.path to be nested object #21636

Conversation

kaiyan-sheng commented Oct 7, 2020 • edited by zube bot Loading

elasticmachine commented Oct 7, 2020

elasticmachine commented Oct 7, 2020

💔 Tests Failed

Build stats

Test stats 🧪

Test errors

Steps errors

Log output

kaiyan-sheng commented Oct 7, 2020 •

edited by zube bot

Loading