Adding back missing @timestamp fields to golden files (elastic#10669)…

… (elastic#10686) (cherry picked from commit 79db54a)
ycombinator · Feb 12, 2019 · d6d117a · d6d117a
1 parent a4ca319
commit d6d117a
Show file tree

Hide file tree

Showing 13 changed files with 146 additions and 0 deletions.
diff --git a/filebeat/module/elasticsearch/audit/test/test-access.log-expected.json b/filebeat/module/elasticsearch/audit/test/test-access.log-expected.json
@@ -1,5 +1,6 @@
 [
     {
+        "@timestamp": "2018-06-19T05:16:15.549Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "event.dataset": "elasticsearch.audit",
@@ -15,6 +16,7 @@
         "user.name": "i030648"
     },
     {
+        "@timestamp": "2018-06-19T05:07:52.304Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "elasticsearch.node.name": "v_VJhjV",
@@ -31,6 +33,7 @@
         "user.name": "rado"
     },
     {
+        "@timestamp": "2018-06-19T05:00:15.778Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.action": "indices:data/read/scroll/clear",
         "elasticsearch.audit.layer": "transport",
@@ -48,6 +51,7 @@
         "user.name": "_xpack_security"
     },
     {
+        "@timestamp": "2018-06-19T05:07:45.544Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "elasticsearch.node.name": "v_VJhjV",
@@ -63,6 +67,7 @@
         "url.original": "/_xpack/security/_authenticate"
     },
     {
+        "@timestamp": "2018-06-19T05:26:27.268Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "event.dataset": "elasticsearch.audit",
@@ -78,6 +83,7 @@
         "user.name": "N078801"
     },
     {
+        "@timestamp": "2018-06-19T05:55:26.898Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.action": "cluster:monitor/main",
         "elasticsearch.audit.layer": "transport",
@@ -95,6 +101,7 @@
         "user.name": "_anonymous"
     },
     {
+        "@timestamp": "2018-06-19T05:24:15.190Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "elasticsearch.node.name": "v_VJhjV",
@@ -112,6 +119,7 @@
         "user.name": "elastic"
     },
     {
+        "@timestamp": "2019-01-08T14:15:02.011Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.action": "indices:data/read/search[free_context]",
         "elasticsearch.audit.indices": [
@@ -144,6 +152,7 @@
         "user.name": "username"
     },
     {
+        "@timestamp": "2019-01-27T20:04:27.244Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "elasticsearch.audit.realm": "default_file",

diff --git a/filebeat/module/elasticsearch/audit/test/test-audit.log-expected.json b/filebeat/module/elasticsearch/audit/test/test-audit.log-expected.json
@@ -1,5 +1,6 @@
 [
     {
+        "@timestamp": "2018-10-31T09:34:25.109Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "elasticsearch.audit.origin.type": "rest",
@@ -19,6 +20,7 @@
         "user.name": "elastic"
     },
     {
+        "@timestamp": "2018-10-31T09:34:25.207Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "elasticsearch.audit.origin.type": "rest",
@@ -38,6 +40,7 @@
         "user.name": "elastic"
     },
     {
+        "@timestamp": "2018-10-31T09:35:11.428Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.action": "cluster:admin/xpack/security/realm/cache/clear",
         "elasticsearch.audit.layer": "transport",
@@ -62,6 +65,7 @@
         "user.name": "_xpack_security"
     },
     {
+        "@timestamp": "2018-10-31T09:35:11.430Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.action": "cluster:admin/xpack/security/realm/cache/clear[n]",
         "elasticsearch.audit.layer": "transport",
@@ -86,6 +90,7 @@
         "user.name": "_xpack_security"
     },
     {
+        "@timestamp": "2018-10-31T09:35:12.303Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.action": "cluster:admin/xpack/security/user/change_password",
         "elasticsearch.audit.layer": "transport",
@@ -110,6 +115,7 @@
         "user.name": "elastic"
     },
     {
+        "@timestamp": "2018-10-31T09:35:12.314Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.action": "indices:admin/create",
         "elasticsearch.audit.indices": [
@@ -137,6 +143,7 @@
         "user.name": "_xpack_security"
     },
     {
+        "@timestamp": "2019-01-27T20:15:10.380Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.audit.layer": "rest",
         "elasticsearch.audit.origin.type": "rest",

diff --git a/filebeat/module/elasticsearch/deprecation/test/elasticsearch_deprecation.log-expected.json b/filebeat/module/elasticsearch/deprecation/test/elasticsearch_deprecation.log-expected.json
@@ -1,5 +1,6 @@
 [
     {
+        "@timestamp": "2018-04-23T16:40:13.737Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
@@ -12,6 +13,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2018-04-23T16:40:13.862Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
@@ -24,6 +26,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2018-04-23T16:40:14.792Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
@@ -36,6 +39,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2018-04-23T16:40:15.127Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",

diff --git a/...t/module/elasticsearch/deprecation/test/other_elasticsearch_deprecation.log-expected.json b/...t/module/elasticsearch/deprecation/test/other_elasticsearch_deprecation.log-expected.json
@@ -1,5 +1,6 @@
 [
     {
+        "@timestamp": "2017-11-30T13:38:16.911Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.c.ParseField",
         "event.dataset": "elasticsearch.deprecation",
@@ -12,6 +13,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T13:38:16.941Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.c.ParseField",
         "event.dataset": "elasticsearch.deprecation",
@@ -24,6 +26,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T13:39:28.986Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -36,6 +39,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T13:39:36.339Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -48,6 +52,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T13:40:49.540Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -60,6 +65,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T14:08:37.413Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -72,6 +78,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T14:08:37.413Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -84,6 +91,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T14:08:46.006Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -96,6 +104,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-11-30T14:08:46.006Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.UidFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -108,6 +117,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-12-01T14:05:54.017Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.AllFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -120,6 +130,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-12-01T14:05:54.019Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.AllFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -132,6 +143,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-12-01T14:06:52.059Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.AllFieldMapper",
         "event.dataset": "elasticsearch.deprecation",
@@ -144,6 +156,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-12-01T14:46:10.428Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.s.a.InternalOrder$Parser",
         "event.dataset": "elasticsearch.deprecation",
@@ -156,6 +169,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-12-04T16:17:18.271Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.a.a.i.t.p.PutIndexTemplateRequest",
         "event.dataset": "elasticsearch.deprecation",
@@ -168,6 +182,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-12-04T16:17:18.282Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.MapperService",
         "event.dataset": "elasticsearch.deprecation",
@@ -180,6 +195,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2017-12-04T16:20:43.248Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.component": "o.e.d.i.m.MapperService",
         "event.dataset": "elasticsearch.deprecation",

diff --git a/filebeat/module/elasticsearch/deprecation/test/test-json.log-expected.json b/filebeat/module/elasticsearch/deprecation/test/test-json.log-expected.json
@@ -1,5 +1,6 @@
 [
     {
+        "@timestamp": "2019-01-30T22:16:20.233Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -16,6 +17,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:16:22.388Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -32,6 +34,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:16:22.566Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -48,6 +51,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:16:24.538Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -64,6 +68,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:16:59.311Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -80,6 +85,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:16:59.922Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -96,6 +102,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:17:00.095Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -112,6 +119,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:17:13.226Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -128,6 +136,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:17:14.747Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -144,6 +153,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:17:14.801Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -160,6 +170,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:17:17.546Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -176,6 +187,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:18:33.367Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",
@@ -192,6 +204,7 @@
         "service.type": "elasticsearch"
     },
     {
+        "@timestamp": "2019-01-30T22:18:46.493Z",
         "ecs.version": "1.0.0-beta2",
         "elasticsearch.cluster.name": "es1",
         "elasticsearch.cluster.uuid": "S4dWw65ZT1eu3SltmAr84A",