Improve ECS categorization field mappings in rabbitmq module

- event.kind Closes #16178
elastic · Apr 22, 2020 · 7c80ee0 · 7c80ee0
1 parent 757e7d1
commit 7c80ee0
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 0 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -268,6 +268,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Enhance `elasticsearch/slowlog` fileset to handle ECS-compatible logs emitted by Elasticsearch. {issue}17715[17715] {pull}17729[17729]
 - Improve ECS categorization field mappings in misp module. {issue}16026[16026] {pull}17344[17344]
 - Added Unix stream socket support as an input source and a syslog input source. {pull}17492[17492]
+- Improve ECS categorization field mappings in rabbitmq module. {issue}16178[16178] {pull}17916[17916]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/rabbitmq/log/ingest/pipeline.yml b/x-pack/filebeat/module/rabbitmq/log/ingest/pipeline.yml
@@ -26,6 +26,9 @@ processors:
 - remove:
     field:
     - timestamp
+- set:
+    field: event.kind
+    value: event
 on_failure:
 - set:
     field: error.message

diff --git a/x-pack/filebeat/module/rabbitmq/log/test/test.log-expected.json b/x-pack/filebeat/module/rabbitmq/log/test/test.log-expected.json
@@ -2,6 +2,7 @@
     {
         "@timestamp": "2019-04-03T11:13:15.076-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -15,6 +16,7 @@
     {
         "@timestamp": "2019-04-03T11:13:15.510-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -31,6 +33,7 @@
     {
         "@timestamp": "2019-04-03T11:13:15.512-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -47,6 +50,7 @@
     {
         "@timestamp": "2019-04-12T10:00:53.458-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -60,6 +64,7 @@
     {
         "@timestamp": "2019-04-12T10:00:53.550-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -76,6 +81,7 @@
     {
         "@timestamp": "2019-04-12T10:00:53.550-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -89,6 +95,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.553-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -102,6 +109,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.555-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -115,6 +123,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.567-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -128,6 +137,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.567-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -141,6 +151,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.568-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -154,6 +165,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.569-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -167,6 +179,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.579-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -180,6 +193,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.588-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -193,6 +207,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.589-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -206,6 +221,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.598-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -219,6 +235,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.606-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -232,6 +249,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.615-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -245,6 +263,7 @@
     {
         "@timestamp": "2019-04-12T10:00:54.615-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -261,6 +280,7 @@
     {
         "@timestamp": "2019-04-12T10:01:01.031-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -277,6 +297,7 @@
     {
         "@timestamp": "2019-04-12T10:11:15.094-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -290,6 +311,7 @@
     {
         "@timestamp": "2019-04-12T10:11:15.101-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -303,6 +325,7 @@
     {
         "@timestamp": "2019-04-12T10:19:14.450-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -319,6 +342,7 @@
     {
         "@timestamp": "2019-04-12T10:19:14.450-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",
@@ -332,6 +356,7 @@
     {
         "@timestamp": "2019-04-12T10:19:14.451-02:00",
         "event.dataset": "rabbitmq.log",
+        "event.kind": "event",
         "event.module": "rabbitmq",
         "event.timezone": "-02:00",
         "fileset.name": "log",