Rename log.path field to log.file.path in filestream to be ECS compli…

…cant (#27761) (#27863) (cherry picked from commit 66eb101) Co-authored-by: Noémi Ványi <kvch@users.noreply.github.com>
elastic · Sep 13, 2021 · a3addc2 · a3addc2
1 parent 0b3b278
commit a3addc2
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -50,6 +50,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add support for GMT timezone offsets in `decode_cef`. {pull}20993[20993]
 - Remove all alias fields pointing to ECS fields from modules. This affects the Suricata and Traefik modules. {issue}10535[10535] {pull}26627[26627]
 - Add option for S3 input to work without SQS notification {issue}18205[18205] {pull}27332[27332]
+- Fix Crowdstrike ingest pipeline that was creating flattened `process` fields. {issue}27622[27622] {pull}27623[27623]
+- Rename `log.path` to `log.file.path` in filestream to be consistent with `log` input and ECS. {pull}27761[27761]
 
 *Heartbeat*
 - Remove long deprecated `watch_poll` functionality. {pull}27166[27166]
@@ -206,6 +208,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Store offset in `log.offset` field of events from the filestream input. {pull}27688[27688]
 - Fix `httpjson` input rate limit processing and documentation. {pull}[]
 - Update Filebeat compatibility function to remove processor description field on ES < 7.9.0 {pull}27774[27774]
+- Make filestream events ECS compliant. {issue}27776[27776]
 
 *Heartbeat*
 

diff --git a/libbeat/reader/readfile/metafields.go b/libbeat/reader/readfile/metafields.go
@@ -51,7 +51,9 @@ func (r *FileMetaReader) Next() (reader.Message, error) {
 	message.Fields.DeepUpdate(common.MapStr{
 		"log": common.MapStr{
 			"offset": r.offset,
-			"path":   r.path,
+			"file": common.MapStr{
+				"path": r.path,
+			},
 		},
 	})
 	return message, err

diff --git a/libbeat/reader/readfile/metafields_test.go b/libbeat/reader/readfile/metafields_test.go
@@ -60,7 +60,9 @@ func TestMetaFieldsOffset(t *testing.T) {
 		if len(msg.Content) != 0 {
 			expectedFields = common.MapStr{
 				"log": common.MapStr{
-					"path":   path,
+					"file": common.MapStr{
+						"path": path,
+					},
 					"offset": offset,
 				},
 			}