From d752325d3a38b387f53c5f834af070b7405767b8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?No=C3=A9mi=20V=C3=A1nyi?= Date: Mon, 20 Jul 2020 13:45:26 +0200 Subject: [PATCH] Ignore missing fields in Zeek module in drop_fields (#19984) (cherry picked from commit 25629c7cc4c7eee8be7c3f162531c85af3ec405d) --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/module/zeek/connection/config/connection.yml | 1 + x-pack/filebeat/module/zeek/files/config/files.yml | 1 + x-pack/filebeat/module/zeek/notice/config/notice.yml | 2 ++ 4 files changed, 5 insertions(+) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 17103d1b541..dc839bf9a9d 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -121,6 +121,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Fixed typo in log message. {pull}17897[17897] - Fix S3 input to trim delimiter /n from each log line. {pull}19972[19972] - Fix s3 input parsing json file without expand_event_list_from_field. {issue}19902[19902] {pull}19962[19962] +- Ignore missing in Zeek module when dropping unecessary fields. {pull}19984[19984] *Heartbeat* diff --git a/x-pack/filebeat/module/zeek/connection/config/connection.yml b/x-pack/filebeat/module/zeek/connection/config/connection.yml index b13737a882d..eb6515c6171 100644 --- a/x-pack/filebeat/module/zeek/connection/config/connection.yml +++ b/x-pack/filebeat/module/zeek/connection/config/connection.yml @@ -12,6 +12,7 @@ json.keys_under_root: false processors: - drop_fields: fields: ["json.orig_bytes","json.resp_bytes","json.tunnel_parents"] + ignore_missing: true - rename: fields: - from: "json" diff --git a/x-pack/filebeat/module/zeek/files/config/files.yml b/x-pack/filebeat/module/zeek/files/config/files.yml index 9f2046e7822..65c067609c9 100644 --- a/x-pack/filebeat/module/zeek/files/config/files.yml +++ b/x-pack/filebeat/module/zeek/files/config/files.yml @@ -12,6 +12,7 @@ json.keys_under_root: false processors: - drop_fields: fields: ["json.x509"] + ignore_missing: true - rename: fields: - from: "json" diff --git a/x-pack/filebeat/module/zeek/notice/config/notice.yml b/x-pack/filebeat/module/zeek/notice/config/notice.yml index 71eef51d512..fa1cc38b31b 100644 --- a/x-pack/filebeat/module/zeek/notice/config/notice.yml +++ b/x-pack/filebeat/module/zeek/notice/config/notice.yml @@ -12,6 +12,7 @@ json.keys_under_root: false processors: - drop_fields: fields: ["json.actions"] + ignore_missing: true - rename: fields: - from: "json" @@ -79,6 +80,7 @@ processors: - drop_fields: fields: ["zeek.notice.remote_location", "zeek.notice.f"] + ignore_missing: true - convert: fields: - {from: "zeek.session_id", to: "event.id"}