Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #18359 to 7.7: [Filebeat] Preserve case of http.request.method #18788

Merged
merged 1 commit into from
May 28, 2020

Conversation

leehinman
Copy link
Contributor

Cherry-pick of PR #18359 to 7.7 branch. Original message:

What does this PR do?

ECS prior to 1.6 specified normalizing http.request.method to lowercase.
ECS team is planning on deprecating the normalization.
This PR removes the normalization. Affects filesets from the
following versions:

  • apache/access (7.7 - 7.8)
  • elasticsearch/audit (7.7 - 7.8)
  • iis/access (7.7 - 7.8)
  • iis/error (7.7 - 7.8)
  • nginx/access (7.8)
  • nginx/ingress_controller (7.8)
  • aws/elb (7.7 - 7.8)
  • suricata/eve (7.4 - 7.8)
  • zeek/http (7.8)

Why is it important?

This resulted in the loss of information that can be used for anomoly detection.
ECS team is planning on deprecated this normalization.

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

mage -v pythonIntegTest

Related issues

* Preserve case of http.request.method

ECS previously specified normalizing http.request.method to lowercase.
This resulted in the loss of information. Affects filesets from the
following versions:

- apache/access (7.7 - 7.8)
- elasticsearch/audit (7.7 - 7.8)
- iis/access (7.7 - 7.8)
- iis/error (7.7 - 7.8)
- nginx/access (7.8)
- nginx/ingress_controller (7.8)
- aws/elb (7.7 - 7.8)
- suricata/eve (7.4 - 7.8)
- zeek/http (7.8)

Closes elastic#18154

(cherry picked from commit 87c3ad3)
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label May 27, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label May 27, 2020
@leehinman leehinman merged commit 932b273 into elastic:7.7 May 28, 2020
@leehinman leehinman deleted the backport_18359_7.7 branch October 5, 2020 19:06
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
…tic#18788)

* Preserve case of http.request.method

ECS previously specified normalizing http.request.method to lowercase.
This resulted in the loss of information. Affects filesets from the
following versions:

- apache/access (7.7 - 7.8)
- elasticsearch/audit (7.7 - 7.8)
- iis/access (7.7 - 7.8)
- iis/error (7.7 - 7.8)
- nginx/access (7.8)
- nginx/ingress_controller (7.8)
- aws/elb (7.7 - 7.8)
- suricata/eve (7.4 - 7.8)
- zeek/http (7.8)

Closes elastic#18154

(cherry picked from commit 5490eb4)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants