Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] Convert o365 client.port to number #22939

Merged
merged 2 commits into from
Dec 10, 2020
Merged

[Filebeat] Convert o365 client.port to number #22939

merged 2 commits into from
Dec 10, 2020

Conversation

andrewkroh
Copy link
Member

What does this PR do?

Convert the client.port and source.port values to numbers in the event to match
the data type used in the ES mapping (and ECS).

Why is it important?

To prevent mapping conflicts it's better to convert the fields to numbers in the pipeline.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Dec 4, 2020
@andrewkroh
Convert o365 client.port to number
f1fba4c 
Convert the client.port and source.port values to numbers in the event to match
the data type used in the ES mapping (and ECS).
@andrewkroh andrewkroh marked this pull request as ready for review December 4, 2020 22:21
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Dec 4, 2020
@elasticmachine
Copy link
Collaborator

elasticmachine commented Dec 4, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #22939 updated

  • Start Time: 2020-12-10T00:18:17.576+0000

  • Duration: 48 min 24 sec

Test stats 🧪

Test Results
Failed 0
Passed 2421
Skipped 261
Total 2682

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 2421
Skipped 261
Total 2682

@andrewkroh andrewkroh merged commit d76d60b into elastic:master Dec 10, 2020
andrewkroh added a commit to andrewkroh/integrations that referenced this pull request Dec 14, 2020
@andrewkroh
Sync pipeline JS
066f6fb 
elastic/beats#22939
@andrewkroh andrewkroh mentioned this pull request Dec 14, 2020
Merged
2 tasks
andrewkroh added a commit to elastic/integrations that referenced this pull request Dec 15, 2020
@andrewkroh
Add system test for Office 365 audit (#449)
7dad36a 
* Add system test for Office 365 audiit

This changes mappings for a few fields to boolean. And it changes client.port and source.port to be numbers in the
JSON source to match their mappings. The remaining issues will be handled by elastic/elastic-package#193.
This is the test output after fixing the booleans.

    FAILURE DETAILS:

    o365/audit :
    [0] parsing field value failed: field "client.port"''s Go type, string, does not match the expected field type: long
    [1] parsing field value failed: field "event.code"''s Go type, float64, does not match the expected field type: keyword
    [2] parsing field value failed: field "o365.audit.ActorYammerUserId"''s Go type, float64, does not match the expected field type: keyword
    [3] parsing field value failed: field "o365.audit.AzureActiveDirectoryEventType"''s Go type, float64, does not match the expected field type: keyword
    [4] parsing field value failed: field "o365.audit.InternalLogonType"''s Go type, float64, does not match the expected field type: keyword
    [5] parsing field value failed: field "o365.audit.LogonType"''s Go type, float64, does not match the expected field type: keyword
    [6] parsing field value failed: field "o365.audit.RecordType"''s Go type, float64, does not match the expected field type: keyword
    [7] parsing field value failed: field "o365.audit.UserType"''s Go type, float64, does not match the expected field type: keyword
    [8] parsing field value failed: field "o365.audit.Version"''s Go type, float64, does not match the expected field type: keyword
    [9] parsing field value failed: field "o365.audit.YammerNetworkId"''s Go type, float64, does not match the expected field type: keyword
    [10] parsing field value failed: field "source.port"''s Go type, string, does not match the expected field type: long
    --- Test results for package: o365 - END   ---

* Configure numeric_keyword_fields

* Sync pipeline JS to get elastic/beats#22939
eyalkraft pushed a commit to build-security/integrations that referenced this pull request Mar 30, 2022
@andrewkroh
Add system test for Office 365 audit (elastic#449)
00c93d9 
* Add system test for Office 365 audiit

This changes mappings for a few fields to boolean. And it changes client.port and source.port to be numbers in the
JSON source to match their mappings. The remaining issues will be handled by elastic/elastic-package#193.
This is the test output after fixing the booleans.

    FAILURE DETAILS:

    o365/audit :
    [0] parsing field value failed: field "client.port"''s Go type, string, does not match the expected field type: long
    [1] parsing field value failed: field "event.code"''s Go type, float64, does not match the expected field type: keyword
    [2] parsing field value failed: field "o365.audit.ActorYammerUserId"''s Go type, float64, does not match the expected field type: keyword
    [3] parsing field value failed: field "o365.audit.AzureActiveDirectoryEventType"''s Go type, float64, does not match the expected field type: keyword
    [4] parsing field value failed: field "o365.audit.InternalLogonType"''s Go type, float64, does not match the expected field type: keyword
    [5] parsing field value failed: field "o365.audit.LogonType"''s Go type, float64, does not match the expected field type: keyword
    [6] parsing field value failed: field "o365.audit.RecordType"''s Go type, float64, does not match the expected field type: keyword
    [7] parsing field value failed: field "o365.audit.UserType"''s Go type, float64, does not match the expected field type: keyword
    [8] parsing field value failed: field "o365.audit.Version"''s Go type, float64, does not match the expected field type: keyword
    [9] parsing field value failed: field "o365.audit.YammerNetworkId"''s Go type, float64, does not match the expected field type: keyword
    [10] parsing field value failed: field "source.port"''s Go type, string, does not match the expected field type: long
    --- Test results for package: o365 - END   ---

* Configure numeric_keyword_fields

* Sync pipeline JS to get elastic/beats#22939
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@leehinman leehinman leehinman approved these changes

Assignees
No one assigned
Labels
Filebeat Filebeat review
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@andrewkroh @elasticmachine @leehinman