Osquerybeat: set the raw index name to supress the timestamp suffix (#26545)

aleksmaus · mergify-bot · commit 0e53a9bb6bbb · 2021-06-28T21:06:47.000Z
(cherry picked from commit 67cf2c6)
diff --git a/x-pack/osquerybeat/beater/osquerybeat.go b/x-pack/osquerybeat/beater/osquerybeat.go
@@ -19,6 +19,7 @@ import (
 	"golang.org/x/sync/errgroup"
 
 	"github.com/elastic/beats/v7/libbeat/beat"
+	"github.com/elastic/beats/v7/libbeat/beat/events"
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/logp"
 	"github.com/elastic/beats/v7/libbeat/processors"
@@ -430,7 +431,7 @@ func (bt *osquerybeat) publishEvents(index, actionID, responseID string, hits []
 			event.Fields["response_id"] = responseID
 		}
 		if index != "" {
-			event.Meta = common.MapStr{"index": index}
+			event.Meta = common.MapStr{events.FieldMetaRawIndex: index}
 		}
 
 		bt.client.Publish(event)

Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,7 @@ import (`
`19`	`19`	`"golang.org/x/sync/errgroup"`
`20`	`20`
`21`	`21`	`"github.com/elastic/beats/v7/libbeat/beat"`
	`22`	`+ "github.com/elastic/beats/v7/libbeat/beat/events"`
`22`	`23`	`"github.com/elastic/beats/v7/libbeat/common"`
`23`	`24`	`"github.com/elastic/beats/v7/libbeat/logp"`
`24`	`25`	`"github.com/elastic/beats/v7/libbeat/processors"`
`@@ -430,7 +431,7 @@ func (bt *osquerybeat) publishEvents(index, actionID, responseID string, hits []`
`430`	`431`	`event.Fields["response_id"] = responseID`
`431`	`432`	`}`
`432`	`433`	`if index != "" {`
`433`		`- event.Meta = common.MapStr{"index": index}`
	`434`	`+ event.Meta = common.MapStr{events.FieldMetaRawIndex: index}`
`434`	`435`	`}`
`435`	`436`
`436`	`437`	`bt.client.Publish(event)`