-
Notifications
You must be signed in to change notification settings - Fork 419
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Format port numbers and numeric IDs as strings #454
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice, didn't even know we have this option. Could you add a changelog entry.
LGTM
This has been bugging me for a long time as well! Thanks for submitting this. I'll try to review and merge next week :-) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM. I would say lets get it merged.
I also resolved the merge conflict (hopefully).
I'm all for rendering more straightforward numbers for things that should be easy to copy / paste around, such as PIDs, and the other ones you're improving here. This was much needed 👍 But I have one worry: does formatting numbers as a string have an impact on what we can do with the field in visualizations? Because we can also use a numeral.js format for I'm not a huge fan of having Kibana implementation details in ECS, for obvious reasons 😆 But #425 is how I ended up mitigating an issue with The fact that it's a really Kibana-specific implementation detail I think is acceptable for now. If it becomes a problem, we can always add a layer of indirection in the future 😉 |
Formats do not affect how fields can be queried or aggregated on. It's still possible to create a histogram on any of these fields, or to filter for low port numbers in Discover (e.g. |
Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
…454) Backport of PR #467 to 1.0 branch. Original message: Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
…trings (elastic#467) Backport of PR elastic#454 to 1.0 branch. Original message: Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
Have you talked to the SIEM folks? |
@Randy-312 I'm on the SIEM team :) Changing the display format does not affect the type of queries or aggregations you can run on these fields. |
It has been bugging me for some time that in Kibana things like port numbers and PIDs are displayed using a thousand separator, e.g.
process.pid: 20,123
.This PR changes the display format to
string
where appropriate (I went through all numeric fields).Changed fields are: