Skip to content

Commit 932b273

Browse files
leehinmanleehinman
authored
[Filebeat] Preserve case of http.request.method (#18359) (#18788)
* Preserve case of http.request.method ECS previously specified normalizing http.request.method to lowercase. This resulted in the loss of information. Affects filesets from the following versions: - apache/access (7.7 - 7.8) - elasticsearch/audit (7.7 - 7.8) - iis/access (7.7 - 7.8) - iis/error (7.7 - 7.8) - nginx/access (7.8) - nginx/ingress_controller (7.8) - aws/elb (7.7 - 7.8) - suricata/eve (7.4 - 7.8) - zeek/http (7.8) Closes #18154 (cherry picked from commit 87c3ad3)
1 parent d3c4978 commit 932b273

31 files changed

+106
-121
lines changed

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
2222
*Filebeat*
2323

2424
- Fix parsing of Elasticsearch node name by `elasticsearch/slowlog` fileset. {pull}14547[14547]
25+
- Preserve case of http.request.method. ECS prior to 1.6 specified normalizing to lowercase, which lost information. Affects filesets: apache/access, elasticsearch/audit, iis/access, iis/error, aws/elb, suricata/eve. {issue}18154[18154] {pull}18359[18359]
2526

2627
*Heartbeat*
2728

‎filebeat/module/apache/access/ingest/pipeline.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,6 @@ processors:
3434
field: event.outcome
3535
value: failure
3636
if: "ctx?.http?.response?.status_code != null && ctx.http.response.status_code > 399"
37-
- lowercase:
38-
field: http.request.method
39-
ignore_missing: true
4037
- grok:
4138
field: source.address
4239
ignore_missing: true

‎filebeat/module/apache/access/test/darwin-2.4.23.log-expected.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"event.module": "apache",
88
"event.outcome": "success",
99
"fileset.name": "access",
10-
"http.request.method": "get",
10+
"http.request.method": "GET",
1111
"http.response.body.bytes": 45,
1212
"http.response.status_code": 200,
1313
"http.version": "1.1",
@@ -27,7 +27,7 @@
2727
"event.module": "apache",
2828
"event.outcome": "failure",
2929
"fileset.name": "access",
30-
"http.request.method": "get",
30+
"http.request.method": "GET",
3131
"http.response.body.bytes": 209,
3232
"http.response.status_code": 404,
3333
"http.version": "1.1",
@@ -63,7 +63,7 @@
6363
"event.module": "apache",
6464
"event.outcome": "success",
6565
"fileset.name": "access",
66-
"http.request.method": "get",
66+
"http.request.method": "GET",
6767
"http.response.body.bytes": 45,
6868
"http.response.status_code": 200,
6969
"http.version": "1.1",
@@ -92,7 +92,7 @@
9292
"event.module": "apache",
9393
"event.outcome": "failure",
9494
"fileset.name": "access",
95-
"http.request.method": "get",
95+
"http.request.method": "GET",
9696
"http.response.body.bytes": 206,
9797
"http.response.status_code": 404,
9898
"http.version": "1.1",
@@ -121,7 +121,7 @@
121121
"event.module": "apache",
122122
"event.outcome": "failure",
123123
"fileset.name": "access",
124-
"http.request.method": "get",
124+
"http.request.method": "GET",
125125
"http.response.body.bytes": 201,
126126
"http.response.status_code": 404,
127127
"http.version": "1.1",

‎filebeat/module/apache/access/test/ssl-request.log-expected.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"event.kind": "event",
99
"event.module": "apache",
1010
"fileset.name": "access",
11-
"http.request.method": "get",
11+
"http.request.method": "GET",
1212
"http.response.body.bytes": 1375,
1313
"http.version": "1.1",
1414
"input.type": "log",
@@ -30,7 +30,7 @@
3030
"event.kind": "event",
3131
"event.module": "apache",
3232
"fileset.name": "access",
33-
"http.request.method": "get",
33+
"http.request.method": "GET",
3434
"http.version": "1.1",
3535
"input.type": "log",
3636
"log.offset": 276,

‎filebeat/module/apache/access/test/test-vhost.log-expected.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
"event.module": "apache",
99
"event.outcome": "failure",
1010
"fileset.name": "access",
11-
"http.request.method": "get",
11+
"http.request.method": "GET",
1212
"http.request.referrer": "-",
1313
"http.response.body.bytes": 499,
1414
"http.response.status_code": 404,

‎filebeat/module/apache/access/test/test.log-expected.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"event.module": "apache",
88
"event.outcome": "failure",
99
"fileset.name": "access",
10-
"http.request.method": "get",
10+
"http.request.method": "GET",
1111
"http.response.body.bytes": 209,
1212
"http.response.status_code": 404,
1313
"http.version": "1.1",
@@ -27,7 +27,7 @@
2727
"event.module": "apache",
2828
"event.outcome": "failure",
2929
"fileset.name": "access",
30-
"http.request.method": "get",
30+
"http.request.method": "GET",
3131
"http.request.referrer": "-",
3232
"http.response.body.bytes": 499,
3333
"http.response.status_code": 404,
@@ -71,7 +71,7 @@
7171
"event.module": "apache",
7272
"event.outcome": "failure",
7373
"fileset.name": "access",
74-
"http.request.method": "get",
74+
"http.request.method": "GET",
7575
"http.request.referrer": "-",
7676
"http.response.body.bytes": 612,
7777
"http.response.status_code": 404,
@@ -99,7 +99,7 @@
9999
"event.module": "apache",
100100
"event.outcome": "success",
101101
"fileset.name": "access",
102-
"http.request.method": "get",
102+
"http.request.method": "GET",
103103
"http.request.referrer": "-",
104104
"http.response.body.bytes": 612,
105105
"http.response.status_code": 200,

‎filebeat/module/apache/access/test/ubuntu-2.2.22.log-expected.json‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
"event.module": "apache",
88
"event.outcome": "success",
99
"fileset.name": "access",
10-
"http.request.method": "get",
10+
"http.request.method": "GET",
1111
"http.request.referrer": "-",
1212
"http.response.body.bytes": 491,
1313
"http.response.status_code": 200,
@@ -33,7 +33,7 @@
3333
"event.module": "apache",
3434
"event.outcome": "success",
3535
"fileset.name": "access",
36-
"http.request.method": "get",
36+
"http.request.method": "GET",
3737
"http.request.referrer": "-",
3838
"http.response.body.bytes": 484,
3939
"http.response.status_code": 200,
@@ -61,7 +61,7 @@
6161
"event.module": "apache",
6262
"event.outcome": "failure",
6363
"fileset.name": "access",
64-
"http.request.method": "get",
64+
"http.request.method": "GET",
6565
"http.request.referrer": "http://192.168.33.72/",
6666
"http.response.body.bytes": 504,
6767
"http.response.status_code": 404,
@@ -89,7 +89,7 @@
8989
"event.module": "apache",
9090
"event.outcome": "success",
9191
"fileset.name": "access",
92-
"http.request.method": "get",
92+
"http.request.method": "GET",
9393
"http.request.referrer": "-",
9494
"http.response.body.bytes": 484,
9595
"http.response.status_code": 200,
@@ -117,7 +117,7 @@
117117
"event.module": "apache",
118118
"event.outcome": "failure",
119119
"fileset.name": "access",
120-
"http.request.method": "get",
120+
"http.request.method": "GET",
121121
"http.request.referrer": "-",
122122
"http.response.body.bytes": 504,
123123
"http.response.status_code": 404,
@@ -145,7 +145,7 @@
145145
"event.module": "apache",
146146
"event.outcome": "failure",
147147
"fileset.name": "access",
148-
"http.request.method": "get",
148+
"http.request.method": "GET",
149149
"http.request.referrer": "-",
150150
"http.response.body.bytes": 504,
151151
"http.response.status_code": 404,
@@ -173,7 +173,7 @@
173173
"event.module": "apache",
174174
"event.outcome": "failure",
175175
"fileset.name": "access",
176-
"http.request.method": "get",
176+
"http.request.method": "GET",
177177
"http.request.referrer": "-",
178178
"http.response.body.bytes": 498,
179179
"http.response.status_code": 404,
@@ -201,7 +201,7 @@
201201
"event.module": "apache",
202202
"event.outcome": "failure",
203203
"fileset.name": "access",
204-
"http.request.method": "get",
204+
"http.request.method": "GET",
205205
"http.request.referrer": "-",
206206
"http.response.body.bytes": 499,
207207
"http.response.status_code": 404,
@@ -229,7 +229,7 @@
229229
"event.module": "apache",
230230
"event.outcome": "failure",
231231
"fileset.name": "access",
232-
"http.request.method": "get",
232+
"http.request.method": "GET",
233233
"http.request.referrer": "-",
234234
"http.response.body.bytes": 499,
235235
"http.response.status_code": 404,

‎filebeat/module/elasticsearch/audit/ingest/pipeline.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,6 @@ processors:
4040
ctx.event.outcome = 'failure';
4141
}
4242
43-
- lowercase:
44-
field: http.request.method
45-
ignore_missing: true
4643
- set:
4744
field: host.id
4845
value: "{{elasticsearch.node.id}}"

‎filebeat/module/elasticsearch/audit/test/test-audit-docker.log-expected.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
"event.outcome": "failure",
1414
"fileset.name": "audit",
1515
"host.id": "Xaq2BFVcQ1OhyMrjL8gNOg",
16-
"http.request.method": "get",
16+
"http.request.method": "GET",
1717
"input.type": "log",
1818
"log.offset": 0,
1919
"message": "{\"type\": \"audit\", \"timestamp\":\"2019-06-11T15:03:32,102+0000\", \"node.id\":\"Xaq2BFVcQ1OhyMrjL8gNOg\", \"event.type\":\"rest\", \"event.action\":\"anonymous_access_denied\", \"origin.type\":\"rest\", \"origin.address\":\"172.17.0.1:40380\", \"url.path\":\"/\", \"request.method\":\"GET\", \"request.id\":\"pkduyMB5Tly6xgmkYbZi-A\"}",
@@ -37,7 +37,7 @@
3737
"event.outcome": "failure",
3838
"fileset.name": "audit",
3939
"host.id": "Xaq2BFVcQ1OhyMrjL8gNOg",
40-
"http.request.method": "get",
40+
"http.request.method": "GET",
4141
"input.type": "log",
4242
"log.offset": 690,
4343
"message": "{\"type\": \"audit\", \"timestamp\":\"2019-06-11T15:03:32,778+0000\", \"node.id\":\"Xaq2BFVcQ1OhyMrjL8gNOg\", \"event.type\":\"rest\", \"event.action\":\"authentication_failed\", \"user.name\":\"elastic\", \"origin.type\":\"rest\", \"origin.address\":\"172.17.0.1:40380\", \"url.path\":\"/\", \"request.method\":\"GET\", \"request.id\":\"KPgEINaXSbGNaIobp8OcMw\"}",

‎filebeat/module/elasticsearch/audit/test/test-audit.log-expected.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@
202202
"fileset.name": "audit",
203203
"host.id": "y8fa3M5zSSGo1M_KJRMUXw",
204204
"http.request.body.content": "\n{\n \"query\" : {\n \"term\" : { \"user\" : \"kimchy\" }\n }\n}\n",
205-
"http.request.method": "get",
205+
"http.request.method": "GET",
206206
"input.type": "log",
207207
"log.offset": 2056,
208208
"message": "{\"@timestamp\":\"2019-01-27T20:15:10,380\", \"node.name\":\"node-0\", \"node.id\":\"y8fa3M5zSSGo1M_KJRMUXw\", \"event.type\":\"rest\", \"event.action\":\"authentication_success\", \"user.name\":\"elastic-admin\", \"origin.type\":\"rest\", \"origin.address\":\"[::1]:58955\", \"realm\":\"default_file\", \"url.path\":\"/_search\", \"request.method\":\"GET\", \"request.body\":\"\\n{\\n \\\"query\\\" : {\\n \\\"term\\\" : { \\\"user\\\" : \\\"kimchy\\\" }\\n }\\n}\\n\", \"request.id\":\"WzL_kb6VSvOhAq0twPvHOQ\"}",

0 commit comments

Comments
 (0)