Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for recursive structures in packetbeat's ECS field handlers #42116

Open
wants to merge 6 commits into
base: main
Choose a base branch
from
+99 −1
Open

Add support for recursive structures in packetbeat's ECS field handlers #42116

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
9cda9e9
add support for recursive structures in ECS
fearful-symmetry Dec 18, 2024
c5999f4
tinkering
fearful-symmetry Dec 18, 2024
af03097
Merge remote-tracking branch 'upstream/main' into ecs-marshal-recurse
fearful-symmetry Dec 18, 2024
757d4ec
changelog
fearful-symmetry Dec 18, 2024
652fa9a
fix timestamps I broke
fearful-symmetry Dec 18, 2024
fe8e6b6
add tests, more checks
fearful-symmetry Dec 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,6 +238,8 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]

*Packetbeat*

- Properly marshal nested structs in ECS fields, fixing issues with mixed cases in field names {pull}42116[42116]


*Winlogbeat*

Expand Down
16 changes: 15 additions & 1 deletion packetbeat/pb/event.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -416,8 +416,17 @@ func marshalStruct(m mapstr.M, key string, val reflect.Value) error {
}

fearful-symmetry marked this conversation as resolved.
Show resolved Hide resolved
typ := val.Type()
// pre-emptively handle time
if reflect.TypeOf(time.Time{}) == typ {
fearful-symmetry marked this conversation as resolved.
Show resolved Hide resolved
_, err := m.Put(key, val.Interface())
if err != nil {
return fmt.Errorf("error creating time value: %w", err)
}
return nil
}
for i := 0; i < typ.NumField(); i++ {
structField := typ.Field(i)

tag := getTag(structField)
if tag == "" {
continue
Expand All @@ -431,7 +440,7 @@ func marshalStruct(m mapstr.M, key string, val reflect.Value) error {
case "inline":
inline = true
default:
return fmt.Errorf("Unsupported flag %q in tag %q of type %s", flag, tag, typ)
return fmt.Errorf("unsupported flag %q in tag %q of type %s", flag, tag, typ)
}
}
tag = tags[0]
Expand All @@ -446,6 +455,11 @@ func marshalStruct(m mapstr.M, key string, val reflect.Value) error {
if err := marshalStruct(m, key, fieldValue); err != nil {
return err
}
// assume a pointer is a struct or other object we can marshal
} else if structField.Type.Kind() == reflect.Ptr || structField.Type.Kind() == reflect.Struct {
fearful-symmetry marked this conversation as resolved.
Show resolved Hide resolved
if err := marshalStruct(m, key+"."+tag, fieldValue); err != nil {
return err
}
} else {
if _, err := m.Put(key+"."+tag, fieldValue.Interface()); err != nil {
return err
Expand Down
17 changes: 17 additions & 0 deletions packetbeat/pb/event_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,15 @@ import (
func TestMarshalMapStr(t *testing.T) {
f := NewFields()
f.Source = &ecs.Source{IP: "127.0.0.1"}
// make sure recursion works properly
f.Process = &ecs.Process{
Parent: &ecs.Process{
Name: "Foo",
Parent: &ecs.Process{
Name: "Bar",
},
},
}

m := mapstr.M{}
if err := f.MarshalMapStr(m); err != nil {
Expand All @@ -45,6 +54,14 @@ func TestMarshalMapStr(t *testing.T) {
"type": []string{"connection", "protocol"},
},
"source": mapstr.M{"ip": "127.0.0.1"},
"process": mapstr.M{
"parent": mapstr.M{
"name": "Foo",
"parent": mapstr.M{
"name": "Bar",
},
},
},
}, m)
}

Expand Down
Loading