diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 8a70e12d8d50..46a95df13b4d 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -73,6 +73,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Several text fields in the Logstash module are now indexed as `keyword` fields with `text` multi-fields (ECS). {pull}10417[10417] - Several text fields in the Elasticsearch module are now indexed as `keyword` fields with `text` multi-fields (ECS). {pull}10414[10414] - Move dissect pattern for traefik.access fileset from Filbeat to Elasticsearch. {pull}10442[10442] +- The `elasticsearch/deprecation` fileset now indexes the `component` field under `elasticsearch` instead of `elasticsearch.server`. {pull}10445[10445] *Heartbeat* @@ -231,6 +232,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Add support for Percona in the `slowlog` fileset of `mysql` module. {issue}6665[6665] {pull}10227[10227] - Added support for ingesting structured Elasticsearch audit logs {pull}10352[10352] - Added support for ingesting structured Elasticsearch slow logs {pull}10445[10445] +- Added support for ingesting structured Elasticsearch deprecation logs {pull}10445[10445] *Heartbeat* diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc index 8e7d5333596b..1a69b644226b 100644 --- a/filebeat/docs/fields.asciidoc +++ b/filebeat/docs/fields.asciidoc @@ -4352,6 +4352,8 @@ UUID of the cluster *`elasticsearch.cluster.name`*:: + -- +type: keyword + example: docker-cluster Name of the cluster diff --git a/filebeat/module/elasticsearch/_meta/fields.yml b/filebeat/module/elasticsearch/_meta/fields.yml index aaeb1037eb18..02f9f4cac1bf 100644 --- a/filebeat/module/elasticsearch/_meta/fields.yml +++ b/filebeat/module/elasticsearch/_meta/fields.yml @@ -18,6 +18,7 @@ - name: cluster.name description: "Name of the cluster" example: "docker-cluster" + type: keyword - name: node.id description: "ID of the node" example: "DSiWcTyeThWtUXLB9J0BMw" diff --git a/filebeat/module/elasticsearch/deprecation/config/log.yml b/filebeat/module/elasticsearch/deprecation/config/log.yml index 95c6d1bd6bfa..e7c07ee6ec2e 100644 --- a/filebeat/module/elasticsearch/deprecation/config/log.yml +++ b/filebeat/module/elasticsearch/deprecation/config/log.yml @@ -5,7 +5,7 @@ paths: {{ end }} exclude_files: [".gz$","_slowlog.log$","_access.log$"] multiline: - pattern: '^\[[0-9]{4}-[0-9]{2}-[0-9]{2}' + pattern: '^(\[[0-9]{4}-[0-9]{2}-[0-9]{2}|{)' negate: true match: after diff --git a/filebeat/module/elasticsearch/deprecation/ingest/pipeline-json.json b/filebeat/module/elasticsearch/deprecation/ingest/pipeline-json.json new file mode 100755 index 000000000000..e8a74768c281 --- /dev/null +++ b/filebeat/module/elasticsearch/deprecation/ingest/pipeline-json.json @@ -0,0 +1,102 @@ +{ + "description": "Pipeline for parsing the Elasticsearch deprecation log file in JSON format.", + "on_failure": [ + { + "set": { + "field": "error.message", + "value": "{{ _ingest.on_failure_message }}" + } + } + ], + "processors": [ + { + "json": { + "field": "message", + "target_field": "elasticsearch.deprecation" + } + }, + { + "drop": { + "if": "ctx.elasticsearch.deprecation.type != 'deprecation'" + } + }, + { + "remove": { + "field": "elasticsearch.deprecation.type" + } + }, + { + "rename": { + "field": "elasticsearch.deprecation.level", + "target_field": "log.level" + } + }, + { + "rename": { + "field": "elasticsearch.deprecation.component", + "target_field": "elasticsearch.component" + } + }, + { + "dot_expander": { + "field": "cluster.name", + "path": "elasticsearch.deprecation" + } + }, + { + "rename": { + "field": "elasticsearch.deprecation.cluster.name", + "target_field": "elasticsearch.cluster.name" + } + }, + { + "dot_expander": { + "field": "node.name", + "path": "elasticsearch.deprecation" + } + }, + { + "rename": { + "field": "elasticsearch.deprecation.node.name", + "target_field": "elasticsearch.node.name" + } + }, + { + "dot_expander": { + "field": "cluster.uuid", + "path": "elasticsearch.deprecation" + } + }, + { + "rename": { + "field": "elasticsearch.deprecation.cluster.uuid", + "target_field": "elasticsearch.cluster.uuid", + "ignore_missing": true + } + }, + { + "dot_expander": { + "field": "node.id", + "path": "elasticsearch.deprecation" + } + }, + { + "rename": { + "field": "elasticsearch.deprecation.node.id", + "target_field": "elasticsearch.node.id", + "ignore_missing": true + } + }, + { + "remove": { + "field": "message" + } + }, + { + "rename": { + "field": "elasticsearch.deprecation.message", + "target_field": "message" + } + } + ] +} diff --git a/filebeat/module/elasticsearch/deprecation/ingest/pipeline-plaintext.json b/filebeat/module/elasticsearch/deprecation/ingest/pipeline-plaintext.json new file mode 100755 index 000000000000..6fdb52514e8e --- /dev/null +++ b/filebeat/module/elasticsearch/deprecation/ingest/pipeline-plaintext.json @@ -0,0 +1,24 @@ +{ + "description": "Pipeline for parsing the Elasticsearch deprecation log file in plaintext format.", + "on_failure": [ + { + "set": { + "field": "error.message", + "value": "{{ _ingest.on_failure_message }}" + } + } + ], + "processors": [ + { + "grok": { + "field": "message", + "pattern_definitions": { + "GREEDYMULTILINE": "(.|\n)*" + }, + "patterns": [ + "\\[%{TIMESTAMP_ISO8601:elasticsearch.deprecation.timestamp}\\]\\[%{LOGLEVEL:log.level}%{SPACE}*\\]\\[%{DATA:elasticsearch.component}%{SPACE}*\\] %{GREEDYMULTILINE:message}" + ] + } + } + ] +} diff --git a/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json b/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json old mode 100755 new mode 100644 index 8f126f11e2f0..3c9169194548 --- a/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json +++ b/filebeat/module/elasticsearch/deprecation/ingest/pipeline.json @@ -1,13 +1,5 @@ { - "description": "Pipeline for parsing the Elasticsearch deprecation log file.", - "on_failure": [ - { - "set": { - "field": "error.message", - "value": "{{ _ingest.on_failure_message }}" - } - } - ], + "description": "Pipeline for parsing elasticsearch deprecation logs", "processors": [ { "rename": { @@ -18,17 +10,29 @@ { "grok": { "field": "message", - "pattern_definitions": { - "GREEDYMULTILINE": "(.|\n)*" - }, "patterns": [ - "\\[%{TIMESTAMP_ISO8601:timestamp}\\]\\[%{LOGLEVEL:log.level}%{SPACE}*\\]\\[%{DATA:elasticsearch.server.component}%{SPACE}*\\] %{GREEDYMULTILINE:message}" - ] + "^%{CHAR:first_char}" + ], + "pattern_definitions": { + "CHAR": "." + } + } + }, + { + "pipeline": { + "if": "ctx.first_char != '{'", + "name": "{< IngestPipeline "pipeline-plaintext" >}" + } + }, + { + "pipeline": { + "if": "ctx.first_char == '{'", + "name": "{< IngestPipeline "pipeline-json" >}" } }, { "date": { - "field": "timestamp", + "field": "elasticsearch.deprecation.timestamp", "target_field": "@timestamp", "formats": [ "ISO8601" @@ -39,7 +43,22 @@ }, { "remove": { - "field": "timestamp" + "field": "elasticsearch.deprecation.timestamp" + } + }, + { + "remove": { + "field": [ + "first_char" + ] + } + } + ], + "on_failure": [ + { + "set": { + "field": "error.message", + "value": "{{ _ingest.on_failure_message }}" } } ] diff --git a/filebeat/module/elasticsearch/deprecation/manifest.yml b/filebeat/module/elasticsearch/deprecation/manifest.yml index 28525f4f3da3..46389067c5ff 100644 --- a/filebeat/module/elasticsearch/deprecation/manifest.yml +++ b/filebeat/module/elasticsearch/deprecation/manifest.yml @@ -4,10 +4,13 @@ var: - name: paths default: - /var/log/elasticsearch/*_deprecation.log + - /var/log/elasticsearch/*_deprecation.json os.darwin: - /usr/local/var/lib/elasticsearch/*_deprecation.log + - /usr/local/var/lib/elasticsearch/*_deprecation.json os.windows: - c:/ProgramData/Elastic/Elasticsearch/logs/*_deprecation.log + - c:/ProgramData/Elastic/Elasticsearch/logs/*_deprecation.json - name: convert_timezone default: false # if ES < 6.1.0, this flag switches to false automatically when evaluating the @@ -16,5 +19,8 @@ var: version: 6.1.0 value: false -ingest_pipeline: ingest/pipeline.json +ingest_pipeline: + - ingest/pipeline.json + - ingest/pipeline-plaintext.json + - ingest/pipeline-json.json input: config/log.yml diff --git a/filebeat/module/elasticsearch/deprecation/test/elasticsearch_deprecation.log-expected.json b/filebeat/module/elasticsearch/deprecation/test/elasticsearch_deprecation.log-expected.json index 9324b6c97e85..156c28f746e9 100644 --- a/filebeat/module/elasticsearch/deprecation/test/elasticsearch_deprecation.log-expected.json +++ b/filebeat/module/elasticsearch/deprecation/test/elasticsearch_deprecation.log-expected.json @@ -2,7 +2,7 @@ { "@timestamp": "2018-04-23T16:40:13.737Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", + "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -15,7 +15,7 @@ { "@timestamp": "2018-04-23T16:40:13.862Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", + "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -28,7 +28,7 @@ { "@timestamp": "2018-04-23T16:40:14.792Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", + "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -41,7 +41,7 @@ { "@timestamp": "2018-04-23T16:40:15.127Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", + "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", diff --git a/filebeat/module/elasticsearch/deprecation/test/other_elasticsearch_deprecation.log-expected.json b/filebeat/module/elasticsearch/deprecation/test/other_elasticsearch_deprecation.log-expected.json index 2f00331f2c1c..1241db9006e8 100644 --- a/filebeat/module/elasticsearch/deprecation/test/other_elasticsearch_deprecation.log-expected.json +++ b/filebeat/module/elasticsearch/deprecation/test/other_elasticsearch_deprecation.log-expected.json @@ -2,7 +2,7 @@ { "@timestamp": "2017-11-30T13:38:16.911Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.c.ParseField", + "elasticsearch.component": "o.e.d.c.ParseField", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -15,7 +15,7 @@ { "@timestamp": "2017-11-30T13:38:16.941Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.c.ParseField", + "elasticsearch.component": "o.e.d.c.ParseField", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -28,7 +28,7 @@ { "@timestamp": "2017-11-30T13:39:28.986Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.UidFieldMapper", + "elasticsearch.component": "o.e.d.i.m.UidFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -41,7 +41,7 @@ { "@timestamp": "2017-11-30T13:39:36.339Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.UidFieldMapper", + "elasticsearch.component": "o.e.d.i.m.UidFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -54,7 +54,7 @@ { "@timestamp": "2017-11-30T13:40:49.540Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.UidFieldMapper", + "elasticsearch.component": "o.e.d.i.m.UidFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -67,7 +67,7 @@ { "@timestamp": "2017-11-30T14:08:37.413Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.UidFieldMapper", + "elasticsearch.component": "o.e.d.i.m.UidFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -80,7 +80,7 @@ { "@timestamp": "2017-11-30T14:08:37.413Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.UidFieldMapper", + "elasticsearch.component": "o.e.d.i.m.UidFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -93,7 +93,7 @@ { "@timestamp": "2017-11-30T14:08:46.006Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.UidFieldMapper", + "elasticsearch.component": "o.e.d.i.m.UidFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -106,7 +106,7 @@ { "@timestamp": "2017-11-30T14:08:46.006Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.UidFieldMapper", + "elasticsearch.component": "o.e.d.i.m.UidFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -119,7 +119,7 @@ { "@timestamp": "2017-12-01T14:05:54.017Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.AllFieldMapper", + "elasticsearch.component": "o.e.d.i.m.AllFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -132,7 +132,7 @@ { "@timestamp": "2017-12-01T14:05:54.019Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.AllFieldMapper", + "elasticsearch.component": "o.e.d.i.m.AllFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -145,7 +145,7 @@ { "@timestamp": "2017-12-01T14:06:52.059Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.AllFieldMapper", + "elasticsearch.component": "o.e.d.i.m.AllFieldMapper", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -158,7 +158,7 @@ { "@timestamp": "2017-12-01T14:46:10.428Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.s.a.InternalOrder$Parser", + "elasticsearch.component": "o.e.d.s.a.InternalOrder$Parser", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -171,7 +171,7 @@ { "@timestamp": "2017-12-04T16:17:18.271Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", + "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -184,7 +184,7 @@ { "@timestamp": "2017-12-04T16:17:18.282Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.MapperService", + "elasticsearch.component": "o.e.d.i.m.MapperService", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", @@ -197,7 +197,7 @@ { "@timestamp": "2017-12-04T16:20:43.248Z", "ecs.version": "1.0.0-beta2", - "elasticsearch.server.component": "o.e.d.i.m.MapperService", + "elasticsearch.component": "o.e.d.i.m.MapperService", "event.dataset": "elasticsearch.deprecation", "event.module": "elasticsearch", "fileset.name": "deprecation", diff --git a/filebeat/module/elasticsearch/deprecation/test/test-json.log b/filebeat/module/elasticsearch/deprecation/test/test-json.log new file mode 100644 index 000000000000..c6852de59d29 --- /dev/null +++ b/filebeat/module/elasticsearch/deprecation/test/test-json.log @@ -0,0 +1,13 @@ +{"type": "deprecation", "timestamp": "2019-01-30T14:16:20,233-0800", "level": "WARN", "component": "o.e.d.r.a.d.RestGetAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in document get requests is deprecated, use the /{index}/_doc/{id} endpoint instead." } +{"type": "deprecation", "timestamp": "2019-01-30T14:16:22,388-0800", "level": "WARN", "component": "o.e.d.a.b.BulkRequest", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in bulk requests is deprecated." } +{"type": "deprecation", "timestamp": "2019-01-30T14:16:22,566-0800", "level": "WARN", "component": "o.e.d.r.a.d.RestUpdateAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in document update requests is deprecated, use the endpoint /{index}/_update/{id} instead." } +{"type": "deprecation", "timestamp": "2019-01-30T14:16:24,538-0800", "level": "WARN", "component": "o.e.d.r.a.s.RestSearchAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in search requests is deprecated." } +{"type": "deprecation", "timestamp": "2019-01-30T14:16:59,311-0800", "level": "WARN", "component": "o.e.d.x.s.r.a.u.RestChangePasswordAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[PUT /_xpack/security/user/{username}/_password] is deprecated! Use [PUT /_security/user/{username}/_password] instead." } +{"type": "deprecation", "timestamp": "2019-01-30T14:16:59,922-0800", "level": "WARN", "component": "o.e.d.x.s.r.a.u.RestChangePasswordAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[PUT /_xpack/security/user/{username}/_password] is deprecated! Use [PUT /_security/user/{username}/_password] instead." } +{"type": "deprecation", "timestamp": "2019-01-30T14:17:00,095-0800", "level": "WARN", "component": "o.e.d.x.s.r.a.u.RestChangePasswordAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[PUT /_xpack/security/user/{username}/_password] is deprecated! Use [PUT /_security/user/{username}/_password] instead." } +{"type": "deprecation", "timestamp": "2019-01-30T14:17:13,226-0800", "level": "WARN", "component": "o.e.d.r.a.d.RestGetAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in document get requests is deprecated, use the /{index}/_doc/{id} endpoint instead." } +{"type": "deprecation", "timestamp": "2019-01-30T14:17:14,747-0800", "level": "WARN", "component": "o.e.d.a.b.BulkRequest", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in bulk requests is deprecated." } +{"type": "deprecation", "timestamp": "2019-01-30T14:17:14,801-0800", "level": "WARN", "component": "o.e.d.r.a.d.RestUpdateAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in document update requests is deprecated, use the endpoint /{index}/_update/{id} instead." } +{"type": "deprecation", "timestamp": "2019-01-30T14:17:17,546-0800", "level": "WARN", "component": "o.e.d.r.a.s.RestSearchAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in search requests is deprecated." } +{"type": "deprecation", "timestamp": "2019-01-30T14:18:33,367-0800", "level": "WARN", "component": "o.e.d.x.w.a.i.IndexAction", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Specifying types in a watcher index action is deprecated." } +{"type": "deprecation", "timestamp": "2019-01-30T14:18:46,493-0800", "level": "WARN", "component": "o.e.d.i.q.QueryShardContext", "cluster.name": "es1", "node.name": "es1_1", "cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", "node.id": "gCoNXf3qSQ6a190zBKr7Bw", "message": "[types removal] Using the _type field in queries and aggregations is deprecated, prefer to use a field instead." } diff --git a/filebeat/module/elasticsearch/deprecation/test/test-json.log-expected.json b/filebeat/module/elasticsearch/deprecation/test/test-json.log-expected.json new file mode 100644 index 000000000000..8664764a21ac --- /dev/null +++ b/filebeat/module/elasticsearch/deprecation/test/test-json.log-expected.json @@ -0,0 +1,223 @@ +[ + { + "@timestamp": "2019-01-30T22:16:20.233Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.r.a.d.RestGetAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 0, + "message": "[types removal] Specifying types in document get requests is deprecated, use the /{index}/_doc/{id} endpoint instead.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:16:22.388Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.a.b.BulkRequest", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 387, + "message": "[types removal] Specifying types in bulk requests is deprecated.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:16:22.566Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.r.a.d.RestUpdateAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 717, + "message": "[types removal] Specifying types in document update requests is deprecated, use the endpoint /{index}/_update/{id} instead.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:16:24.538Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.r.a.s.RestSearchAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 1113, + "message": "[types removal] Specifying types in search requests is deprecated.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:16:59.311Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.x.s.r.a.u.RestChangePasswordAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 1452, + "message": "[PUT /_xpack/security/user/{username}/_password] is deprecated! Use [PUT /_security/user/{username}/_password] instead.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:16:59.922Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.x.s.r.a.u.RestChangePasswordAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 1856, + "message": "[PUT /_xpack/security/user/{username}/_password] is deprecated! Use [PUT /_security/user/{username}/_password] instead.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:17:00.095Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.x.s.r.a.u.RestChangePasswordAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 2260, + "message": "[PUT /_xpack/security/user/{username}/_password] is deprecated! Use [PUT /_security/user/{username}/_password] instead.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:17:13.226Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.r.a.d.RestGetAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 2664, + "message": "[types removal] Specifying types in document get requests is deprecated, use the /{index}/_doc/{id} endpoint instead.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:17:14.747Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.a.b.BulkRequest", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 3051, + "message": "[types removal] Specifying types in bulk requests is deprecated.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:17:14.801Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.r.a.d.RestUpdateAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 3381, + "message": "[types removal] Specifying types in document update requests is deprecated, use the endpoint /{index}/_update/{id} instead.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:17:17.546Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.r.a.s.RestSearchAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 3777, + "message": "[types removal] Specifying types in search requests is deprecated.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:18:33.367Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.x.w.a.i.IndexAction", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 4116, + "message": "[types removal] Specifying types in a watcher index action is deprecated.", + "service.type": "elasticsearch" + }, + { + "@timestamp": "2019-01-30T22:18:46.493Z", + "ecs.version": "1.0.0-beta2", + "elasticsearch.cluster.name": "es1", + "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A", + "elasticsearch.component": "o.e.d.i.q.QueryShardContext", + "elasticsearch.node.id": "gCoNXf3qSQ6a190zBKr7Bw", + "elasticsearch.node.name": "es1_1", + "event.dataset": "elasticsearch.deprecation", + "event.module": "elasticsearch", + "fileset.name": "deprecation", + "input.type": "log", + "log.level": "WARN", + "log.offset": 4459, + "message": "[types removal] Using the _type field in queries and aggregations is deprecated, prefer to use a field instead.", + "service.type": "elasticsearch" + } +] \ No newline at end of file diff --git a/filebeat/module/elasticsearch/fields.go b/filebeat/module/elasticsearch/fields.go index 9796731ed2e7..3a822014be64 100644 --- a/filebeat/module/elasticsearch/fields.go +++ b/filebeat/module/elasticsearch/fields.go @@ -32,5 +32,5 @@ func init() { // AssetElasticsearch returns asset data. // This is the base64 encoded gzipped contents of module/elasticsearch. func AssetElasticsearch() string { - return "eJzUmllv2zr2wN/7KQ788r8FEv2dpZnGwFygddMkRZc0W6fXDQSaOpZYU6RCUnZ8i373ASnZkbV5mbbT8UsbcTm/s/DwkNIujHHWA+REG0Y1EkWjJwCGGY496Cw97zwBCFBTxRLDpOjBn08AYHksvJNByvEJwIghD3TPddkFQWKsirE/M0uwB6GSaZI/qZGxPF1xSirjRAoUZtFSmqBzssS36A8jJWOYRqgQTITAZQg4sQ1SsZAJYjDoFCbFBxInzijSQ496sfcODXlFDOkrJAbPRYAPV6gmjGJxXKbfGGdTqYIqPk+1QeWlKQsaNbi5OX8FcuQw8wH1ZKfxRA3P+PtrdnX7mV2Mno8fwuNwcxr7VyPNexLjWjSBpGNUu5U+c2lCBui1qP2otO1ZL+PVFftEr2d4HX0yN/96+/L4Tfflu+n6GjuGtdVt5ph8ev9G/3WwvmBmw6Vdsoso171e5ohxHCIxuwa12WUiSc2m8tus76SzhjVAPpyGr6bDm8tR//bZP15c0fthP9zA7joiKmgVH8yN7rrWU3TXF0jSgJlK72LaqTD8WWgop5/i1JzMUC21lJW5tvnF9ponHUYjMBHTlYzTA4Xa7IBRROhEKtsGLPFHjJfW2bIl7Khya71BiuSZXM92bOX/tMiSCu9T1FVi+KPakilL4PLk6hpeXJzPBz8tqrcYNyUaFFJkEwxACiftsRuNiBDIn+4Al5Rw365E+CPL25RwtzKBaZ1iUOR82myxx3k2t5tCwuOVHiepiVAYRol9mA1ycKUGq/mEcBY4o5GQMFF1Zg7esXkVRyTlxsbEFuypRuWtp4Dt+n+6Vo8dYKNiw/JeWQIm1LAJ+gFTSI1Us22hJUfdCn1pe4CRixWGkCgmKEsIhyFyKULdGBED6IzZkAjiW2mdHejY5Kp9EsRMdOBuY2irthQrrSwKG0w2BExEsgWBD0jTZuP2oJPvrr1YCmak+v+YMLGFfRX3EqJIvMK+diXfXJ6D64sGVbM5O9+sGe30//xK6FgwGu1/X58MIE65YX5d4i2SG3wwlcb5xJXGwu7H6IpgOs/6AKEUtcYAhrPcP20hNJJyd7+7d+x197zuoY2ipScHlSdH24RWnt6WN9CqCjeC3acIWSGVj2l22Ke/3/rj4dHt1eRD9OK+a6YXk7MPH7fJjhlcqbip4tnot9MV6DYJ/T5Hoq6okpxf1uu2Nqs/lMGsdjDhjJTjJCEm6kFkTOLNdbXjPSqFWT6J2F/MQkUyjY1KsRbDlQF+zT68CsINrNvA15GabdU+CQKFujz/Kslapoqix5ItBKeKbSjNJqi8suBbCFzsApuK1dXTUJvMubwAE4XZfvnjas755CHdfk6A0z7YwkGjyQV4a5a5SUR0fXiWpa8gsL/XThDoBCkbMWr37NN+JsIrdV61A9S4B1ZsLWsA2l/x6HfaByo5x2yDrgUtuD/NosPXSBvRRlySuq1rDbB+iWQh0G5WUgVMhNailvsNmRCYMGVSwiEmNGKiBVxTlQ59PYuHkvuGDDn6hsX4s/SAC5JqBCsCmACNVIpAA+VIhNUhTSBjAceiV4IbxUT4C8DX4HYoK7mnSMa+wpH2EyVtneH4fyL5tWXWiT11Pkp0GKBwhAqFrXkelWpGtzUg58h9hZoS8auoC/aOiRpbes4mCHL4FanRtvTnCCRJ+PzAwjRoI5MEg2ZlKCda+6ngkgS/SpNMmosXkdoC00GsaX2apI6zkbEuKa/JeJEFBvQvbrIYz+MF1Uiq2AI/psIaxOaUDaUjXYORYaWh11TE/kpKyNRoFmSXGWNUAnmdAoXEMtP/BUomypDQSmnP5L8C81oawgE5SWy8lqCNdLfrHE1GXtgv3U2QNkS5XiMmmI682irj6yT2VSoalmCzIisUcEcNi+pI3ty+y2nSpLDadoBoINn0NsoTyYQBkcZDVPW0JlJIAu0baxffZpmm5LE1+SlRQxIuWTOXCk6qy225G+qSxiKQbQp0u8uc+Ueb2CIYKcfWxRlUztnKZUhYf/SoL91WWasPXIZhtvWGDSIjJOXMuHUhe4YkAcK5zDcbIoK5X9jfG9eydow/HjYmdSYMhpXL5jUwYbF4rfJOjg38MeNyODNtFYrdmX4a0o1NI46oGWZxWuWBH2L5Pm1rx33gAYQoMC+cJaVpQgSd/f4edM6TI2uQoga/gTsbbbrauzOZivBH+veznfB/3MOzsg6/gY9b7FpPt7AbqsmS0OXLwCvX7F7Dl19s1MdA1U9t3wSUxb2V4WO/5XvDbd/0N29ctTc3ZaJs66qbsBr9bfc0Lmja1konc+Fpv/lqtf4itW4V1q+WRc4W1QPKMktZUhvFnIPLioKLamIqf4XAhX4TVBGSwNd432ryK7xP7dE6ryYbLX9weHh8fLxfa/5GisfS0J9fBHkr3uQsH6hP+zv2n5hxzvJirZFw76jbXbNkXFhpaNc+2QzQJUJX1loj52/0CkXwlOh8Ygw2oH++Fv0iZ3E55TJsTlpZe3YNr7PDxUn5m6kKRGew3917vts92t0/vt7r9rpHvb3DneODg7vB+fvXH+BukH2dkU3h5RDefYpqdgeDiX/7Jvp6eweDGI1i1H0DcuQdeN1dO6/XPfL2j+4G3TtXjQ8OvWexvttxf/iZkQaH7m97ZomY0YO948ODZ/bRLEE9uNuxhyOT/cchuDcTg483J5ef/euzk/f+65Pr/tliDveFhh7s2f7urcDg25eOo/3S6X370omJoZFPOM/+HEqpzZdOb8/rfv/+/W7nP0n1ttgv7WSVPB+iqnxFU/RGrbFHaJa9tzq7WwO3kLglx8ziiJS/4HJHZWesJr6DbjfWG6JYR7ax2PYmeZuJcqHSIurKtmcebZToWvc2lPsYmW3Ss6/+bK8m4eWw3hDDBbzvHNjGweW03csbLJnNCPHBKOJnnC2EJ7Zbrg4wMZIqJtWX3dtGyWOyaYvK7IDKTFOgHO5vITTLTivFWuMzDLLPzZoA9jcDUDI1rLRpl79YcT2ajKy7e2d/7X98OT7+Oj0MTUheG7GZ4UtfCCxJPw9+jG/bl+B1y9oLJG2T9e8AAAD//6Kq7D0=" + return "eJzUmllv2zr2wN/7KQ788r8FEv2dpZnGwFygddMkRZc0W6fXDQSaOpZYU6RCUnZ8i373ASnZkbV5mbbT8UsbcTm/s/DwkNIujHHWA+REG0Y1EkWjJwCGGY496Cw97zwBCFBTxRLDpOjBn08AYHksvJNByvEJwIghD3TPddkFQWKsirE/M0uwB6GSaZI/qZGxPF1xSirjRAoUZtFSmqBzssS36A8jJWOYRqgQTITAZQg4sQ1SsZAJYjDoFCbFBxInzijSQ496sfcODXlFDOkrJAbPRYAPV6gmjGJxXKbfGGdTqYIqPk+1QeWlKQsaNbi5OX8FcuQw8wH1ZKfxRA3P+PtrdnX7mV2Mno8fwuNwcxr7VyPNexLjWjSBpGNUuzV92imEDNBrMcejMWzPetmvrtgnej3D6+iTufnX25fHb7ov3003ZFjbDM0ck0/v3+i/DtYXzGwYtUt2kea618scMY5DJGbXoDa7TCSp2VR+m/WddNawNsiH0/DVdHhzOerfPvvHiyt6P+yHG9hdR0QFreKDudFd13qK7voCSRowU+ldTEcVhj8LDeW0VJyakxmqpZayMtc279he82TEaAQmYrqSiXqgUJsdMIoInUhl24Al/ojx0tpatoQdVW6tN0iRPJPr2Y6t/J8W2VPhfYq6Sgx/VFsyZQlcnlxdw4uL8/ngp0X1FuOmRINCimyCAUjhpD12oxERAvnTHeCSEu7blQh/ZPmcEu5WJjCtUwyKnE+bLfY4z+Z2U0h4vNLjJDURCsMosQ+zQQ6u1GA1nxDOAmc0EhImqs7MwTs23+KIpNzYmNiCPdWovPUUsF3/T9fqsQNsVGxY3kNLwIQaNkE/YAqpkWq2LbTkqFuhL20PMHKxwhASxQRlCeEwRC5FqBsjYgCdMRsSQXwrrbMDHZtctU+CmIkO3G0MbdWWYqWVRWGDyYaAiUi2IPABadps3B508l23F0vBjFT/HxMmtrCv4l5CFIlX2Neu5JvLc3B90aBqNmfnmzWjnf6fXwkdC0aj/e/rkwHEKTfMr0u8RXKDD6bSOJ+40ljY/RhdEUznWR8glKLWGMBwlvunLYRGUu7ud/eOve6e1z20UbT05KDy5Gib0MrT2/IGWlXhRrD7FCErpPIxzQ779Pdbfzw8ur2afIhe3HfN9GJy9uHjNtkxgysVN1U8G/12ugLdJqHf50jUFVWS88t63dZm9YcymNUOJpyRcpwkxEQ9iIxJvLmudrxHpTDLJxT7i1moSKaxUSnWYrgywK/Zh1dBuIF1G/g6UrOt2idBoFCX518lWctUUfRYsoXgVLENpdkElVcWfAuBi11gU7G6ekpqkzmXF2CiMNsvf1zNOZ88pNvPCXDaB1s4aDS5AG/NMjeJiK4Pz7L0FQT299oJAp0gZSNG7Z592s9EeKXOq3aAGvfAiq1lDUD7Kx79TvtAJeeYbdC1oAX3p1l0+BppI9qIS1K3da0B1i+RLATazUqqgInQWtRyvyETAhOmTEo4xIRGTLSAa6rSoa9n8VBy35AhR9+wGH+WHnBBUo1gRQAToJFKEWigHImwOqQJZCzgWPRKcKOYCH8B+BrcDmUl9xTJ2Fc40n6ipK0zHP9PJL+2zDqxp85HiQ4DFI5QobA1z6NSzei2BuQcua9QUyJ+FXXB3jFRY0vP2QRBDr8iNdqW/hyBJAmfH1iYBm1kkmDQrAzlRGs/FVyS4Fdpkklz8SJSW2A6iDWtT5PUcTYy1iXlNRkvssCA/sVNFuN5vKAaSRVb4MdUWIPYnLKhdKRrMDKsNPSaithfSQmZGs2C7DJjjEogr1OgkFhm+r9AyUQZElop7Zn8V2BeS0M4ICeJjdcStJHu1p2jycgL+6W7CdKGKNdrxATTkVdbZXydxL5KRcMSbFZkhQLuqGFRHcmb23c5TZoUVtsOEA0km95GeSKZMCDSeIiqntZECkmgfWPt4tss05Q8tiY/JWpIwiVr5lLBSXW5LXdDXdJYBLJNgW53mTP/aBNbBCPl2Lo4g8o5W7kMCeuPHvWl2ypr9YHLMMy23rBBZISknBm3LmTPkCRAOJf5ZkNEMPcL+3vjWtaO8cfDxqTOhMGwctm8BiYsFq9V3smxgT9mXA5npq1CsTvTT0O6sWnEETXDLE6rPPBDLN+nbe24DzyAEAXmhbOkNE2IoLPf34POeXJkDVLU4DdwZ6NNV3t3JlMR/kj/frYT/o97eFbW4TfwcYtd6+kWdkM1WRK6fBl45Zrd6/nyi436GKj6qe1bgbK4tzJ87Ld8b7jtFwDNG1ftzU2ZKNu66iasRn/bPY0Lmra10slceNpvvlqtv0itW4X1q2WRs0X1gLLMUpbURjHn4LKi4KKamMpfIXCh3wRVhCTwNd63mvwK71N7tM6ryUbLHxweHh8f79eav5HisTT05xdB3oo3OcsH6tP+jv0nZpyzvFhrJNw76nbXLBkXVhratU82A3SJ0JW11sj5G71CETwlOp8Ygw3on69Fv8hZXE65DJuTVtaeXcPr7HBxUv6WqgLRGex3957vdo9294+v97q97lFv73Dn+ODgbnD+/vUHuBtkX2dkU3g5hHefoprdwWDi376Jvt7ewSBGoxh134AceQded9fO63WPvP2ju0H3zlXjg0PvWazvdtwffmakwaH7255ZImb0YO/48OCZfTRLUA/uduzhyGT/cQjuzcTg483J5Wf/+uzkvf/65Lp/tpjDfaGhB3u2v3srMPj2peNov3R63750YmJo5BPOsz+HUmrzpdPb87rfv3+/2/lPUr0t9ks7WSXPh6gqX9EUvVFr7BGaZe+tzu7WwC0kbskxszgi5S+43FHZGauJ76DbjfWGKNaRbSy2vUneZqJcqLSIurLtmUcbJbrWvQ3lPkZmm/Tsa0Dbq0l4Oaw3xHAB7zsHtnFwOW338gZLZjNCfDCK+BlnC+GJ7ZarA0yMpIpJ9WX3tlHymGzaojI7oDLTFCiH+1sIzbLTSrHW+AyD7HOzJoD9zQCUTA0rbdrlL1ZcjyYj6+7e2V/7H1+Oj79OD0MTktdGbGb40hcCS9LPgx/j2/YleN2y9gJJ22T9OwAA//9n//Ko" }