From e437b4e5491c6e0fd803e5bf08858ef87f47bf96 Mon Sep 17 00:00:00 2001 From: Marc Guasch Date: Wed, 19 Aug 2020 16:41:31 +0200 Subject: [PATCH] [Auditbeat] Change event.kind=error to event.kind=event to comply with ECS (#20685) * Change event.kind=error to event.kind=event to coply with ECS * Add CHANGELOG entry --- CHANGELOG.next.asciidoc | 1 + x-pack/auditbeat/module/system/process/process.go | 5 ++--- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index e94b224985b..0dcf9c23716 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -23,6 +23,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d *Auditbeat* - File integrity dataset (macOS): Replace unnecessary `file.origin.raw` (type keyword) with `file.origin.text` (type `text`). {issue}12423[12423] {pull}15630[15630] +- Change event.kind=error to event.kind=event to comply with ECS. {issue}18870[18870] {pull}20685[20685] *Filebeat* diff --git a/x-pack/auditbeat/module/system/process/process.go b/x-pack/auditbeat/module/system/process/process.go index 6c9e5a7db6a..3fd94e5ea96 100644 --- a/x-pack/auditbeat/module/system/process/process.go +++ b/x-pack/auditbeat/module/system/process/process.go @@ -39,7 +39,6 @@ const ( eventTypeState = "state" eventTypeEvent = "event" - eventTypeError = "error" ) type eventAction uint8 @@ -247,7 +246,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error { report.Event(event) } else { ms.log.Warn(p.Error) - report.Event(ms.processEvent(p, eventTypeError, eventActionProcessError)) + report.Event(ms.processEvent(p, eventTypeEvent, eventActionProcessError)) } } @@ -287,7 +286,7 @@ func (ms *MetricSet) reportChanges(report mb.ReporterV2) error { report.Event(ms.processEvent(p, eventTypeEvent, eventActionProcessStarted)) } else { ms.log.Warn(p.Error) - report.Event(ms.processEvent(p, eventTypeError, eventActionProcessError)) + report.Event(ms.processEvent(p, eventTypeEvent, eventActionProcessError)) } }