Skip to content

[Filebeat] Improve ECS categorization in elasticsearch module #16469

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Mar 12, 2020
Merged

[Filebeat] Improve ECS categorization in elasticsearch module #16469

merged 11 commits into from
Mar 12, 2020

Conversation

@leehinman
Copy link
Contributor

@leehinman leehinman commented Feb 20, 2020

  • slowlog
    • event.kind
    • event.category
    • event.type
    • host.name
    • host.id
  • server
    • event.kind
    • event.category
    • event.type
    • host.name
    • host.id
  • gc
    • event.kind
    • event.category
    • event.type
  • deprecation
    • event.kind
    • event.category
    • event.type
    • host.id
    • host.name
  • audit
    • event.kind
    • event.category
    • event.type
    • event.outcome
    • lowercase http.request.method
    • host.id
    • host.name
    • related.user
  • converted all pipelines to yaml

@leehinman leehinman added enhancement Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. Team:SIEM ecs labels Feb 20, 2020
@leehinman leehinman requested a review from a team as a code owner February 20, 2020 20:53
@elasticmachine
Copy link
Contributor

elasticmachine commented Feb 20, 2020

Pinging @elastic/siem (Team:SIEM)

@leehinman leehinman force-pushed the 16160_elasticsearch_ecs_1.4 branch from e5362e1 to 2689b9f Compare February 20, 2020 20:56
@andrewkroh andrewkroh requested a review from ycombinator March 10, 2020 15:39
ycombinator
ycombinator approved these changes Mar 10, 2020
View reviewed changes
Copy link
Contributor

@ycombinator ycombinator left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

Looks like there's a merge conflict, BTW.

leehinman added 11 commits March 12, 2020 14:47
@leehinman
Switch elasticsearch pipeline from json to yml
ab2d062
@leehinman
Update elasticsearch audit fileset to ECS 1.4
1dbcaea 
- event.kind
- event.category
- event.type
- event.outcome
- lowercase http.request.method
- host.id
- host.name
- related.user
@leehinman
convert elasticsearch deprecation pipeline to yaml
3639251
@leehinman
update elassticsearch deprecation fileset to ECS 1.4
a9c2ca9 
- event.kind
- event.category
- event.type
- host.id
- host.name
@leehinman
Convert elasticsearch gc pipeline to yml
cf6d0d7
@leehinman
Add ECS categorizations to elasticsearch gc pipeline
a0dd4f8 
- event.kind
- event.category
- event.type
@leehinman
convert elasticsearch server pipeline to yaml
7ddd7b2
@leehinman
Add ECS 1.4 categorization to elasticsearch server pipeline
9c784ff 
- event.kind
- event.category
- event.type
- host.name
- host.id
@leehinman
Convert elasticsearch slowlog pipeline to yaml
2cf392c
@leehinman
Add ECS 1.4 categorization to elasticsearch slowlog pipeline
9f7888f 
- event.kind
- event.category
- event.type
- host.name
- host.id
@leehinman
add changelog entry
ce85bd6
@leehinman leehinman force-pushed the 16160_elasticsearch_ecs_1.4 branch from 2689b9f to ce85bd6 Compare March 12, 2020 19:48
@leehinman leehinman merged commit 3c13de5 into elastic:master Mar 12, 2020
@leehinman leehinman mentioned this pull request Mar 12, 2020
Merged
@leehinman leehinman added v7.7.0 and removed needs_backport PR is waiting to be backported to other branches. labels Mar 12, 2020
leehinman added a commit to leehinman/beats that referenced this pull request Mar 12, 2020
@leehinman
[Filebeat] Improve ECS categorization in elasticsearch module (elasti…
fef9166 
…c#16469)

- event.kind
- event.category
- event.type
- event.outcome
- lowercase http.request.method
- host.id
- host.name
- related.user

Closes elastic#16160

(cherry picked from commit 3c13de5)
@leehinman leehinman deleted the 16160_elasticsearch_ecs_1.4 branch March 12, 2020 19:54
leehinman added a commit that referenced this pull request Mar 16, 2020
@leehinman
[Filebeat] Improve ECS categorization in elasticsearch module (#16469) (
bd344fc 
#16986)

- event.kind
- event.category
- event.type
- event.outcome
- lowercase http.request.method
- host.id
- host.name
- related.user

Closes #16160

(cherry picked from commit 3c13de5)
@ycombinator ycombinator mentioned this pull request Mar 25, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ycombinator ycombinator ycombinator approved these changes

Assignees

No one assigned

Labels

ecs enhancement Filebeat Filebeat v7.7.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@leehinman @elasticmachine @ycombinator