Format port numbers and numeric IDs as strings#454
Conversation
ruflin
left a comment
ruflin
left a comment
There was a problem hiding this comment.
Nice, didn't even know we have this option. Could you add a changelog entry.
LGTM
|
This has been bugging me for a long time as well! Thanks for submitting this. I'll try to review and merge next week :-) |
ruflin
left a comment
ruflin
left a comment
There was a problem hiding this comment.
LGTM. I would say lets get it merged.
I also resolved the merge conflict (hopefully).
|
I'm all for rendering more straightforward numbers for things that should be easy to copy / paste around, such as PIDs, and the other ones you're improving here. This was much needed 👍 But I have one worry: does formatting numbers as a string have an impact on what we can do with the field in visualizations? Because we can also use a numeral.js format for I'm not a huge fan of having Kibana implementation details in ECS, for obvious reasons 😆 But #425 is how I ended up mitigating an issue with The fact that it's a really Kibana-specific implementation detail I think is acceptable for now. If it becomes a problem, we can always add a layer of indirection in the future 😉
|
Formats do not affect how fields can be queried or aggregated on. It's still possible to create a histogram on any of these fields, or to filter for low port numbers in Discover (e.g. |
Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
…454) Backport of PR #467 to 1.0 branch. Original message: Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
…trings (elastic#467) Backport of PR elastic#454 to 1.0 branch. Original message: Changes the display format of things like port numbers and PIDs to string where appropriate. Changed fields are: client.port destination.port event.severity event.sequence (cherry-pick note: not in 1.0) http.response.status_code process.pid process.ppid process.pgid (cherry-pick note: not in 1.0) process.thread.id server.port source.port url.port
|
Have you talked to the SIEM folks? |
|
@Randy-312 I'm on the SIEM team :) Changing the display format does not affect the type of queries or aggregations you can run on these fields. |
4 participants
It has been bugging me for some time that in Kibana things like port numbers and PIDs are displayed using a thousand separator, e.g.
process.pid: 20,123.This PR changes the display format to
stringwhere appropriate (I went through all numeric fields).Changed fields are: