Allow string characters in browser patch version

Both for NGINX and Apache logs (cherry picked from commit a10c1b7)
elastic · May 30, 2017 · 113cb58 · 113cb58
1 parent 73f9d00
commit 113cb58
Show file tree

Hide file tree

Showing 9 changed files with 206 additions and 143 deletions.
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
@@ -41,6 +41,7 @@ https://github.com/elastic/beats/compare/v5.3.0...master[Check the HEAD diff]
 - Fix issue that new prospector was not reloaded on conflict {pull}4128[4128]
 - Fix grok pattern in filebeat module system/auth without hostname. {pull}4224[4224]
 - Fix the Mysql slowlog parsing of IP addresses. {pull}4183[4183]
+- Allow string characters in user agent patch version (NGINX and Apache) {pull}4415[4415]
 
 *Heartbeat*
 

diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
@@ -153,7 +153,7 @@ The minor version of the user agent.
 [float]
 === apache2.access.user_agent.patch
 
-type: long
+type: keyword
 
 The patch version of the user agent.
 
@@ -875,7 +875,7 @@ The minor version of the user agent.
 [float]
 === nginx.access.user_agent.patch
 
-type: long
+type: keyword
 
 The patch version of the user agent.
 

diff --git a/filebeat/filebeat.template-es2x.json b/filebeat/filebeat.template-es2x.json
@@ -124,7 +124,9 @@
                       "type": "string"
                     },
                     "patch": {
-                      "type": "long"
+                      "ignore_above": 1024,
+                      "index": "not_analyzed",
+                      "type": "string"
                     }
                   }
                 },
@@ -534,7 +536,9 @@
                       "type": "string"
                     },
                     "patch": {
-                      "type": "long"
+                      "ignore_above": 1024,
+                      "index": "not_analyzed",
+                      "type": "string"
                     }
                   }
                 },

diff --git a/filebeat/filebeat.template-es6x.json b/filebeat/filebeat.template-es6x.json
@@ -104,7 +104,8 @@
                       "type": "keyword"
                     },
                     "patch": {
-                      "type": "long"
+                      "ignore_above": 1024,
+                      "type": "keyword"
                     }
                   }
                 },
@@ -452,7 +453,8 @@
                       "type": "keyword"
                     },
                     "patch": {
-                      "type": "long"
+                      "ignore_above": 1024,
+                      "type": "keyword"
                     }
                   }
                 },

diff --git a/filebeat/filebeat.template.json b/filebeat/filebeat.template.json
@@ -107,7 +107,8 @@
                       "type": "keyword"
                     },
                     "patch": {
-                      "type": "long"
+                      "ignore_above": 1024,
+                      "type": "keyword"
                     }
                   }
                 },
@@ -455,7 +456,8 @@
                       "type": "keyword"
                     },
                     "patch": {
-                      "type": "long"
+                      "ignore_above": 1024,
+                      "type": "keyword"
                     }
                   }
                 },

diff --git a/filebeat/module/apache2/access/_meta/fields.yml b/filebeat/module/apache2/access/_meta/fields.yml
@@ -61,7 +61,7 @@
           description: >
             The minor version of the user agent.
         - name: patch
-          type: long
+          type: keyword
           description: >
             The patch version of the user agent.
         - name: name

diff --git a/filebeat/module/apache2/access/test/test.log b/filebeat/module/apache2/access/test/test.log
@@ -1,3 +1,4 @@
 ::1 - - [26/Dec/2016:16:16:29 +0200] "GET /favicon.ico HTTP/1.1" 404 209
 192.168.33.1 - - [26/Dec/2016:16:22:13 +0000] "GET /hello HTTP/1.1" 404 499 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:50.0) Gecko/20100101 Firefox/50.0"
 ::1 - - [26/Dec/2016:16:16:48 +0200] "-" 408 -
+172.17.0.1 - - [29/May/2017:19:02:48 +0000] "GET /stringpatch HTTP/1.1" 404 612 "-" "Mozilla/5.0 (Windows NT 6.1; rv:15.0) Gecko/20120716 Firefox/15.0a2" "-"