From c3917269f5749a92d6ad0ca4d6cc6713fc260a6e Mon Sep 17 00:00:00 2001 From: Lee Hinman <57081003+leehinman@users.noreply.github.com> Date: Thu, 16 Apr 2020 08:45:38 -0500 Subject: [PATCH] [Filebeat] Improve ECS categorization field mappings for nats module (#17550) * Improve ECS categorization field mappings for nats module - event.kind - event.type - related.ip Closes #16173 (cherry picked from commit eb5ba9a02947b8a93085b4733b41f411d4c5c988) --- CHANGELOG.next.asciidoc | 1 + filebeat/module/nats/log/ingest/pipeline.json | 177 ----------------- filebeat/module/nats/log/ingest/pipeline.yml | 181 ++++++++++++++++++ filebeat/module/nats/log/manifest.yml | 2 +- .../nats/log/test/test.log-expected.json | 114 +++++++++++ 5 files changed, 297 insertions(+), 178 deletions(-) delete mode 100644 filebeat/module/nats/log/ingest/pipeline.json create mode 100644 filebeat/module/nats/log/ingest/pipeline.yml diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index db14ba5d23e..38bc4bb2cac 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -326,6 +326,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Improve ECS categorization field mappings for mysql module. {issue}16172[16172] {pull}17491[17491] - Release Google Cloud module as GA. {pull}17511[17511] - Update filebeat httpjson input to support pagination via Header and Okta module. {pull}16354[16354] +- Improve ECS categorization field mappings for nats module. {issue}16173[16173] {pull}17550[17550] *Heartbeat* diff --git a/filebeat/module/nats/log/ingest/pipeline.json b/filebeat/module/nats/log/ingest/pipeline.json deleted file mode 100644 index 0da22c0c8c7..00000000000 --- a/filebeat/module/nats/log/ingest/pipeline.json +++ /dev/null @@ -1,177 +0,0 @@ -{ - "description": "Pipeline for parsing nats log logs", - "processors": [ - { - "grok": { - "field": "message", - "patterns":[ - "\\[%{POSINT:process.pid}\\]( %{NATSTIME:nats.log.timestamp})? \\[%{NATSLOGLEVEL:log.level}\\] %{GREEDYDATA:nats.log.info}" - ], - "pattern_definitions": { - "NATSTIME": "%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{TIME}", - "NATSLOGLEVEL":"(INF|DBG|WRN|ERR|FTL|TRC)" - }, - "ignore_missing": true - } - }, - { - "grok": { - "field": "nats.log.info", - "patterns": [ - "%{IPV4:client.ip}:%{POSINT:client.port} - cid:%{POSINT:nats.log.client.id} - %{GREEDYDATA:nats.log.msg.info}", - "%{GREEDYDATA:nats.log.msg.data}" - ], - "ignore_missing": true - } - }, - { - "grok": { - "field": "nats.log.msg.info", - "patterns": [ - "%{NATSDIRECTION:network.direction} %{NATSPAYLOAD:nats.log.msg.type}: \\[%{GREEDYDATA:nats.log.msg.payload}\\]", - "%{NATSDIRECTION:network.direction} \\[%{NATSNOINFO:nats.log.msg.type}\\]", - "%{NATSDIRECTION:network.direction} \\[%{NATSUNSUB:nats.log.msg.type}\\s+%{POSINT:nats.log.msg.sid}(\\s+%{POSINT:nats.log.msg.max_messages})?\\]", - "%{NATSDIRECTION:network.direction} \\[%{NATSPUB:nats.log.msg.type}\\s+%{NOTSPACE:nats.log.msg.subject}(\\s+%{NOTSPACE:nats.log.msg.reply_to})?\\s+%{POSINT:nats.log.msg.bytes}\\]", - "%{NATSDIRECTION:network.direction} \\[%{NATSSUB:nats.log.msg.type}\\s+%{NOTSPACE:nats.log.msg.subject}(\\s+%{NOTSPACE:nats.log.msg.queue_group})?\\s+%{POSINT:nats.log.msg.sid}\\]", - "%{NATSDIRECTION:network.direction} \\[%{NATSMSG:nats.log.msg.type}\\s+%{NOTSPACE:nats.log.msg.subject}\\s+%{POSINT:nats.log.msg.sid}(\\s+%{NOTSPACE:nats.log.msg.reply_to})?\\s+%{POSINT:nats.log.msg.bytes}\\]", - "%{NATSDIRECTION:network.direction} \\[%{NATSCONNECTION:nats.log.msg.type}\\s+%{GREEDYDATA:nats.log.msg.data}\\]", - "%{NATSDIRECTION:network.direction} \\[%{NATSERROR:nats.log.msg.type}\\s+%{GREEDYDATA:nats.log.msg.error\\]", - "%{GREEDYDATA:nats.log.msg.data}" - ], - "pattern_definitions": { - "NATSDIRECTION": "(<<-|->>)", - "NATSMSG": "MSG", - "NATSPUB": "PUB", - "NATSSUB": "SUB", - "NATSUNSUB": "UNSUB", - "NATSPAYLOAD": "MSG_PAYLOAD", - "NATSERROR": "-ERROR", - "NATSPING": "PING", - "NATSPONG": "PONG", - "NATSOK": "OK", - "NATSCONNECT": "CONNECT", - "NATSINFO": "INFO", - "NATSCONNECTION": "(?:%{NATSCONNECT}|%{NATSINFO})", - "NATSNOINFO": "(?:%{NATSPING}|%{NATSPONG}|%{NATSOK})" - }, - "ignore_missing": true - } - }, - { - "remove": { - "field": "nats.log.info" - } - }, - { - "remove": { - "field": "nats.log.msg.info", - "ignore_missing": true - } - }, - { - "remove": { - "field": "nats.log.msg.payload", - "ignore_missing": true - } - }, - { - "remove": { - "field": "message" - } - }, - { - "rename": { - "field": "nats.log.msg.data", - "target_field": "message", - "ignore_missing": true - } - }, - { - "script": { - "lang": "painless", - "source": "if (ctx.log.level == params.inf) {\n ctx.log.level = params.info;\n } else if (ctx.log.level == params.dbg) {\n ctx.log.level = params.debug;\n } else if (ctx.log.level == params.wrn) {\n ctx.log.level = params.warning;\n } else if (ctx.log.level == params.err) {\n ctx.log.level = params.error;\n } else if (ctx.log.level == params.ftl) {\n ctx.log.level = params.fatal;\n } else if (ctx.log.level == params.trc) {\n ctx.log.level = params.trace;\n }", - "params": { - "inf": "INF", - "info": "info", - "dbg": "DBG", - "debug": "debug", - "wrn": "WRN", - "warning": "warning", - "err": "ERR", - "error": "error", - "ftl": "FTL", - "fatal": "fatal", - "trc": "TRC", - "trace": "trace" - } - } - }, - { - "script": { - "lang": "painless", - "source": "if (ctx.nats.log.msg.type == params.msg) {\n ctx.nats.log.msg.type = params.message;\n } else if (ctx.nats.log.msg.type == params.pub) {\n ctx.nats.log.msg.type = params.publish;\n } else if (ctx.nats.log.msg.type == params.sub) {\n ctx.nats.log.msg.type = params.subscribe;\n } else if (ctx.nats.log.msg.type == params.unsub) {\n ctx.nats.log.msg.type = params.unsubscribe;\n } else if (ctx.nats.log.msg.type == params.msg_payload) {\n ctx.nats.log.msg.type = params.payload;\n } else if (ctx.nats.log.msg.type == params.err) {\n ctx.nats.log.msg.type = params.error;\n } else if (ctx.nats.log.msg.type == params.pi) {\n ctx.nats.log.msg.type = params.ping;\n } else if (ctx.nats.log.msg.type == params.po) {\n ctx.nats.log.msg.type = params.pong;\n } else if (ctx.nats.log.msg.type == params.ok) {\n ctx.nats.log.msg.type = params.acknowledge;\n } else if (ctx.nats.log.msg.type == params.connect) {\n ctx.nats.log.msg.type = params.connection;\n } else if (ctx.nats.log.msg.type == params.info) {\n ctx.nats.log.msg.type = params.information;\n }", - "params": { - "msg": "MSG", - "message": "message", - "pub": "PUB", - "publish": "publish", - "sub": "SUB", - "subscribe": "subscribe", - "unsub": "UNSUB", - "unsubscribe": "unsubscribe", - "msg_payload": "MSG_PAYLOAD", - "payload": "payload", - "err": "-ERROR", - "error": "error", - "pi": "PING", - "ping": "ping", - "po": "PONG", - "pong": "pong", - "ok": "OK", - "acknowledge": "acknowledge", - "connect": "CONNECT", - "connection": "connection", - "info": "INFO", - "information": "information" - }, - "if": "ctx.nats.log.msg?.type != null" - } - }, - { - "script": { - "lang": "painless", - "source": "if (ctx.network.direction == params.in) {\n ctx.network.direction = params.inbound;\n } else if (ctx.network.direction == params.out) {\n ctx.network.direction = params.outbound;\n }", - "params": { - "in": "<<-", - "inbound": "inbound", - "out": "->>", - "outbound": "outbound" - }, - "if": "ctx.network?.direction != null" - } - }, - { - "rename": { - "field": "@timestamp", - "target_field": "event.created" - } - }, - { - "date": { - "field": "nats.log.timestamp", - "target_field": "@timestamp", - "formats": ["yyyy/MM/dd HH:mm:ss.SSSSSS"] - } - }, - { - "remove": { - "field": "nats.log.timestamp" - } - }], - "on_failure" : [{ - "set" : { - "field" : "error.message", - "value" : "{{ _ingest.on_failure_message }}" - } - }] -} diff --git a/filebeat/module/nats/log/ingest/pipeline.yml b/filebeat/module/nats/log/ingest/pipeline.yml new file mode 100644 index 00000000000..53c4f774b5e --- /dev/null +++ b/filebeat/module/nats/log/ingest/pipeline.yml @@ -0,0 +1,181 @@ +description: Pipeline for parsing nats log logs +processors: +- grok: + field: message + patterns: + - \[%{POSINT:process.pid}\]( %{NATSTIME:nats.log.timestamp})? \[%{NATSLOGLEVEL:log.level}\] + %{GREEDYDATA:nats.log.info} + pattern_definitions: + NATSTIME: '%{YEAR}/%{MONTHNUM}/%{MONTHDAY} %{TIME}' + NATSLOGLEVEL: (INF|DBG|WRN|ERR|FTL|TRC) + ignore_missing: true +- grok: + field: nats.log.info + patterns: + - '%{IPV4:client.ip}:%{POSINT:client.port} - cid:%{POSINT:nats.log.client.id} + - %{GREEDYDATA:nats.log.msg.info}' + - '%{GREEDYDATA:nats.log.msg.data}' + ignore_missing: true +- grok: + field: nats.log.msg.info + patterns: + - '%{NATSDIRECTION:network.direction} %{NATSPAYLOAD:nats.log.msg.type}: \[%{GREEDYDATA:nats.log.msg.payload}\]' + - '%{NATSDIRECTION:network.direction} \[%{NATSNOINFO:nats.log.msg.type}\]' + - '%{NATSDIRECTION:network.direction} \[%{NATSUNSUB:nats.log.msg.type}\s+%{POSINT:nats.log.msg.sid}(\s+%{POSINT:nats.log.msg.max_messages})?\]' + - '%{NATSDIRECTION:network.direction} \[%{NATSPUB:nats.log.msg.type}\s+%{NOTSPACE:nats.log.msg.subject}(\s+%{NOTSPACE:nats.log.msg.reply_to})?\s+%{POSINT:nats.log.msg.bytes}\]' + - '%{NATSDIRECTION:network.direction} \[%{NATSSUB:nats.log.msg.type}\s+%{NOTSPACE:nats.log.msg.subject}(\s+%{NOTSPACE:nats.log.msg.queue_group})?\s+%{POSINT:nats.log.msg.sid}\]' + - '%{NATSDIRECTION:network.direction} \[%{NATSMSG:nats.log.msg.type}\s+%{NOTSPACE:nats.log.msg.subject}\s+%{POSINT:nats.log.msg.sid}(\s+%{NOTSPACE:nats.log.msg.reply_to})?\s+%{POSINT:nats.log.msg.bytes}\]' + - '%{NATSDIRECTION:network.direction} \[%{NATSCONNECTION:nats.log.msg.type}\s+%{GREEDYDATA:nats.log.msg.data}\]' + - '%{NATSDIRECTION:network.direction} \[%{NATSERROR:nats.log.msg.type}\s+%{GREEDYDATA:nats.log.msg.error\]' + - '%{GREEDYDATA:nats.log.msg.data}' + pattern_definitions: + NATSDIRECTION: (<<-|->>) + NATSMSG: MSG + NATSPUB: PUB + NATSSUB: SUB + NATSUNSUB: UNSUB + NATSPAYLOAD: MSG_PAYLOAD + NATSERROR: -ERROR + NATSPING: PING + NATSPONG: PONG + NATSOK: OK + NATSCONNECT: CONNECT + NATSINFO: INFO + NATSCONNECTION: (?:%{NATSCONNECT}|%{NATSINFO}) + NATSNOINFO: (?:%{NATSPING}|%{NATSPONG}|%{NATSOK}) + ignore_missing: true +- remove: + field: nats.log.info +- remove: + field: nats.log.msg.info + ignore_missing: true +- remove: + field: nats.log.msg.payload + ignore_missing: true +- remove: + field: message +- rename: + field: nats.log.msg.data + target_field: message + ignore_missing: true +- script: + lang: painless + source: |- + if (ctx.log.level == params.inf) { + ctx.log.level = params.info; + } else if (ctx.log.level == params.dbg) { + ctx.log.level = params.debug; + } else if (ctx.log.level == params.wrn) { + ctx.log.level = params.warning; + } else if (ctx.log.level == params.err) { + ctx.log.level = params.error; + } else if (ctx.log.level == params.ftl) { + ctx.log.level = params.fatal; + } else if (ctx.log.level == params.trc) { + ctx.log.level = params.trace; + } + params: + inf: INF + info: info + dbg: DBG + debug: debug + wrn: WRN + warning: warning + err: ERR + error: error + ftl: FTL + fatal: fatal + trc: TRC + trace: trace +- script: + lang: painless + source: |- + if (ctx.nats.log.msg.type == params.msg) { + ctx.nats.log.msg.type = params.message; + } else if (ctx.nats.log.msg.type == params.pub) { + ctx.nats.log.msg.type = params.publish; + } else if (ctx.nats.log.msg.type == params.sub) { + ctx.nats.log.msg.type = params.subscribe; + } else if (ctx.nats.log.msg.type == params.unsub) { + ctx.nats.log.msg.type = params.unsubscribe; + } else if (ctx.nats.log.msg.type == params.msg_payload) { + ctx.nats.log.msg.type = params.payload; + } else if (ctx.nats.log.msg.type == params.err) { + ctx.nats.log.msg.type = params.error; + } else if (ctx.nats.log.msg.type == params.pi) { + ctx.nats.log.msg.type = params.ping; + } else if (ctx.nats.log.msg.type == params.po) { + ctx.nats.log.msg.type = params.pong; + } else if (ctx.nats.log.msg.type == params.ok) { + ctx.nats.log.msg.type = params.acknowledge; + } else if (ctx.nats.log.msg.type == params.connect) { + ctx.nats.log.msg.type = params.connection; + } else if (ctx.nats.log.msg.type == params.info) { + ctx.nats.log.msg.type = params.information; + } + params: + msg: MSG + message: message + pub: PUB + publish: publish + sub: SUB + subscribe: subscribe + unsub: UNSUB + unsubscribe: unsubscribe + msg_payload: MSG_PAYLOAD + payload: payload + err: -ERROR + error: error + pi: PING + ping: ping + po: PONG + pong: pong + ok: OK + acknowledge: acknowledge + connect: CONNECT + connection: connection + info: INFO + information: information + if: ctx.nats.log.msg?.type != null +- script: + lang: painless + source: |- + if (ctx.network.direction == params.in) { + ctx.network.direction = params.inbound; + } else if (ctx.network.direction == params.out) { + ctx.network.direction = params.outbound; + } + params: + in: <<- + inbound: inbound + out: ->> + outbound: outbound + if: ctx.network?.direction != null +- rename: + field: '@timestamp' + target_field: event.created +- date: + field: nats.log.timestamp + target_field: '@timestamp' + formats: + - yyyy/MM/dd HH:mm:ss.SSSSSS +- remove: + field: nats.log.timestamp +- set: + field: event.kind + value: event +- append: + field: event.type + value: info +- append: + field: event.type + value: error + if: "ctx?.log?.level != null && (ctx.log.level == 'error' || ctx.log.level == 'fatal')" +- append: + field: related.ip + value: "{{client.ip}}" + if: "ctx?.client?.ip != null" +on_failure: +- set: + field: error.message + value: '{{ _ingest.on_failure_message }}' diff --git a/filebeat/module/nats/log/manifest.yml b/filebeat/module/nats/log/manifest.yml index 8c51b92a137..86c0d041cb2 100644 --- a/filebeat/module/nats/log/manifest.yml +++ b/filebeat/module/nats/log/manifest.yml @@ -11,5 +11,5 @@ var: # See more on https://nats.io/documentation/server/gnatsd-logging/ - /var/log/nats/nats.log* -ingest_pipeline: ingest/pipeline.json +ingest_pipeline: ingest/pipeline.yml input: config/log.yml diff --git a/filebeat/module/nats/log/test/test.log-expected.json b/filebeat/module/nats/log/test/test.log-expected.json index 34dd0c2f17f..efa4fba7509 100644 --- a/filebeat/module/nats/log/test/test.log-expected.json +++ b/filebeat/module/nats/log/test/test.log-expected.json @@ -2,7 +2,11 @@ { "@timestamp": "2019-02-06T07:19:40.624Z", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "info", @@ -14,7 +18,11 @@ { "@timestamp": "2019-02-06T07:19:40.624Z", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "info", @@ -26,7 +34,11 @@ { "@timestamp": "2019-02-06T07:19:40.624Z", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "info", @@ -38,7 +50,11 @@ { "@timestamp": "2019-02-06T07:19:40.624Z", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "info", @@ -52,7 +68,11 @@ "client.ip": "172.18.0.1", "client.port": "38630", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "debug", @@ -60,6 +80,9 @@ "message": "Client connection created", "nats.log.client.id": "1", "process.pid": "1", + "related.ip": [ + "172.18.0.1" + ], "service.type": "nats" }, { @@ -67,7 +90,11 @@ "client.ip": "172.18.0.1", "client.port": "38630", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -77,6 +104,9 @@ "nats.log.msg.type": "connection", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "172.18.0.1" + ], "service.type": "nats" }, { @@ -84,7 +114,11 @@ "client.ip": "172.18.0.1", "client.port": "38630", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -95,6 +129,9 @@ "nats.log.msg.type": "subscribe", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "172.18.0.1" + ], "service.type": "nats" }, { @@ -102,7 +139,11 @@ "client.ip": "172.18.0.1", "client.port": "38630", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -111,6 +152,9 @@ "nats.log.msg.type": "ping", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "172.18.0.1" + ], "service.type": "nats" }, { @@ -118,7 +162,11 @@ "client.ip": "172.18.0.1", "client.port": "38630", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -127,6 +175,9 @@ "nats.log.msg.type": "pong", "network.direction": "inbound", "process.pid": "1", + "related.ip": [ + "172.18.0.1" + ], "service.type": "nats" }, { @@ -134,7 +185,11 @@ "client.ip": "50.39.246.116", "client.port": "62388", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -146,6 +201,9 @@ "nats.log.msg.type": "publish", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "50.39.246.116" + ], "service.type": "nats" }, { @@ -153,7 +211,11 @@ "client.ip": "50.39.246.116", "client.port": "62388", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -162,6 +224,9 @@ "nats.log.msg.type": "payload", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "50.39.246.116" + ], "service.type": "nats" }, { @@ -169,7 +234,11 @@ "client.ip": "192.168.176.11", "client.port": "36262", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -182,6 +251,9 @@ "nats.log.msg.type": "message", "network.direction": "inbound", "process.pid": "1", + "related.ip": [ + "192.168.176.11" + ], "service.type": "nats" }, { @@ -189,7 +261,11 @@ "client.ip": "192.168.176.11", "client.port": "36262", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -200,6 +276,9 @@ "nats.log.msg.type": "publish", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "192.168.176.11" + ], "service.type": "nats" }, { @@ -207,7 +286,11 @@ "client.ip": "192.168.176.11", "client.port": "36262", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -216,6 +299,9 @@ "nats.log.msg.type": "payload", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "192.168.176.11" + ], "service.type": "nats" }, { @@ -223,7 +309,11 @@ "client.ip": "50.39.246.116", "client.port": "62388", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -235,6 +325,9 @@ "nats.log.msg.type": "message", "network.direction": "inbound", "process.pid": "1", + "related.ip": [ + "50.39.246.116" + ], "service.type": "nats" }, { @@ -242,7 +335,11 @@ "client.ip": "50.39.246.116", "client.port": "62388", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -253,6 +350,9 @@ "nats.log.msg.type": "publish", "network.direction": "outbound", "process.pid": "1", + "related.ip": [ + "50.39.246.116" + ], "service.type": "nats" }, { @@ -260,7 +360,11 @@ "client.ip": "192.168.176.11", "client.port": "36262", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -272,6 +376,9 @@ "nats.log.msg.type": "message", "network.direction": "inbound", "process.pid": "1", + "related.ip": [ + "192.168.176.11" + ], "service.type": "nats" }, { @@ -279,7 +386,11 @@ "client.ip": "172.18.0.1", "client.port": "38630", "event.dataset": "nats.log", + "event.kind": "event", "event.module": "nats", + "event.type": [ + "info" + ], "fileset.name": "log", "input.type": "log", "log.level": "trace", @@ -288,6 +399,9 @@ "nats.log.msg.type": "acknowledge", "network.direction": "inbound", "process.pid": "1", + "related.ip": [ + "172.18.0.1" + ], "service.type": "nats" } ] \ No newline at end of file