Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
inputs:
- data_stream:
namespace: ep
meta:
package:
name: with_legacy_policy_api
name: test-default-with_legacy_policy_api
streams:
- data_stream:
dataset: with_legacy_policy_api.indicator
exclude_files:
- .gz$
paths:
- /var/log/prod-*.log
processors:
- add_locale: null
- add_tags:
tags:
- revoked_true
- env_production
type: logfile
use_output: default
output_permissions:
default:
_elastic_agent_checks:
cluster:
- monitor
_elastic_agent_monitoring:
indices: []
uuid-for-permissions-on-related-indices:
indices:
- names:
- logs-with_legacy_policy_api.indicator-ep
privileges:
- auto_configure
- create_doc
secret_references: []
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
# policy_api_format: legacy is required because this package has a select variable
# (revoked) with "false" as an option value. Fleet's simplified API coerces the
# string "false" to boolean false before validation, causing a 400 error.
policy_api_format: legacy
data_stream:
vars:
revoked: "true"
paths:
- /var/log/prod-*.log
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
inputs:
- data_stream:
namespace: ep
meta:
package:
name: with_legacy_policy_api
name: test-staging-with_legacy_policy_api
streams:
- data_stream:
dataset: with_legacy_policy_api.indicator
exclude_files:
- .gz$
paths:
- /var/log/stag-*.log
processors:
- add_locale: null
- add_tags:
tags:
- revoked_false
- env_staging
type: logfile
use_output: default
output_permissions:
default:
_elastic_agent_checks:
cluster:
- monitor
_elastic_agent_monitoring:
indices: []
uuid-for-permissions-on-related-indices:
indices:
- names:
- logs-with_legacy_policy_api.indicator-ep
privileges:
- auto_configure
- create_doc
secret_references: []
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# policy_api_format: legacy is required because this package has a select variable
# (revoked) with "false" as an option value. Fleet's simplified API coerces the
# string "false" to boolean false before validation, causing a 400 error.
policy_api_format: legacy
vars:
revoked: "false"
environment: "staging"
data_stream:
vars:
paths:
- /var/log/stag-*.log