Cherry-pick #9392 to 6.x: Add geo fields to add_host_metadata processor.#9565
Merged
andrewvc merged 1 commit intoelastic:6.xfrom Dec 17, 2018
Merged
Cherry-pick #9392 to 6.x: Add geo fields to add_host_metadata processor.#9565andrewvc merged 1 commit intoelastic:6.xfrom
add_host_metadata processor.#9565andrewvc merged 1 commit intoelastic:6.xfrom
Conversation
This lets users add geo data if they have it to the host (cherry picked from commit c6c4a30)
ruflin
approved these changes
Dec 17, 2018
Contributor
ruflin
left a comment
There was a problem hiding this comment.
LGTM. I restarted the travis Mac build as it got stuck somehow. If Travis goes green, I'm good to merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of PR #9392 to 6.x branch. Original message:
** EDIT ** I've left the original issue below the break, but after discussion we added geo fields to the
add_host_metadataprocessor instead of a new one. Original is belowThis carries over from the discussion from #8620 .
This adds a new processor that lets users easily add geo fields associated with the host that created the event. You would use it like so:
It's debate-able whether ECS should actually let you put these under perhaps
agent.geo. That's something we should discuss here.One other question here, should we just fold this functionality under
add_host_metadata? I believe that probably makes more sense. We agreed in #8620 to make this a separate processor, but with the data nested under host, that makes less sense IMHO.