From 1795efd413b61e55f077ab3bdd18c2354c8efb50 Mon Sep 17 00:00:00 2001 From: Shaunak Kashyap Date: Tue, 19 May 2020 08:55:10 -0400 Subject: [PATCH] [7.8] Followup to 12606 (#18316) (#18521) * Followup to 12606 (#18316) * Adding developer CHANGELOG entry * Refactoring: extracting helper method * Adding unit tests * Consolidate event metadata field constants * Use events.GetMetaStringValue * Implement op_type values as enum * Add doc strings * Deference event pointer * Renaming op type consts and breaking them out into own block * Renaming type * Using stringer * Using go idiom instead of if-else * Adding default op type * Empty string for default * Store op type enum, not string, in event metadata * Using events.GetMetaStringValue * Updating dev CHANGELOG entry * Allow for op_type metadata field to be set as either string or enum * No need for .String() * Handle missing key case gracefully * Update unit tests * Update developer CHANGELOG entry * Fixing up CHANGELOG --- CHANGELOG-developer.next.asciidoc | 1 + filebeat/channel/connector_test.go | 3 +- journalbeat/input/input_test.go | 3 +- libbeat/beat/event.go | 13 --- libbeat/beat/events/optype.go | 28 ++++++ libbeat/beat/events/optype_string.go | 43 +++++++++ libbeat/beat/events/util.go | 84 +++++++++++++++++ libbeat/beat/events/util_test.go | 90 +++++++++++++++++++ libbeat/idxmgmt/std.go | 23 ++--- .../monitoring/report/elasticsearch/client.go | 13 +-- libbeat/outputs/elasticsearch/client.go | 32 +++---- libbeat/outputs/elasticsearch/client_test.go | 36 ++++---- .../processors/actions/decode_json_fields.go | 3 +- .../add_formatted_index.go | 3 +- .../script/javascript/beatevent_v0_test.go | 3 +- metricbeat/mb/event_test.go | 3 +- .../function/beater/proccessors_test.go | 3 +- 17 files changed, 311 insertions(+), 73 deletions(-) create mode 100644 libbeat/beat/events/optype.go create mode 100644 libbeat/beat/events/optype_string.go create mode 100644 libbeat/beat/events/util.go create mode 100644 libbeat/beat/events/util_test.go diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc index 1b46f7addff..13d0a14ccb0 100644 --- a/CHANGELOG-developer.next.asciidoc +++ b/CHANGELOG-developer.next.asciidoc @@ -79,3 +79,4 @@ The list below covers the major changes between 7.0.0-rc2 and master only. - Add support for MODULE environment variable in `mage goIntegTest` in metricbeat to run integration tests for a single module. {pull}17147[17147] - Add support for a `TEST_TAGS` environment variable to add tags for tests selection following go build tags semantics, this environment variable is used by mage test targets to add build tags. Python tests can also be tagged with a decorator (`@beat.tag('sometag')`). {pull}16937[16937] {pull}17075[17075] - Add fields validation for histogram subfields. {pull}17759[17759] +- Events intended for the Elasticsearch output can now take an `op_type` metadata field of type events.OpType or string to indicate the `op_type` to use for bulk indexing. {pull}12606[12606] diff --git a/filebeat/channel/connector_test.go b/filebeat/channel/connector_test.go index fe6e3299188..b75a0fe5eee 100644 --- a/filebeat/channel/connector_test.go +++ b/filebeat/channel/connector_test.go @@ -25,6 +25,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/processors" "github.com/elastic/beats/v7/libbeat/processors/actions" @@ -183,7 +184,7 @@ func (p *setRawIndex) Run(event *beat.Event) (*beat.Event, error) { if event.Meta == nil { event.Meta = common.MapStr{} } - event.Meta["raw_index"] = p.indexStr + event.Meta[events.FieldMetaRawIndex] = p.indexStr return event, nil } diff --git a/journalbeat/input/input_test.go b/journalbeat/input/input_test.go index f80688b786e..eb925f1ef0b 100644 --- a/journalbeat/input/input_test.go +++ b/journalbeat/input/input_test.go @@ -25,6 +25,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/processors" _ "github.com/elastic/beats/v7/libbeat/processors/actions" @@ -138,7 +139,7 @@ func (p *setRawIndex) Run(event *beat.Event) (*beat.Event, error) { if event.Meta == nil { event.Meta = common.MapStr{} } - event.Meta["raw_index"] = p.indexStr + event.Meta[events.FieldMetaRawIndex] = p.indexStr return event, nil } diff --git a/libbeat/beat/event.go b/libbeat/beat/event.go index 183b56b1ce8..4ef56042039 100644 --- a/libbeat/beat/event.go +++ b/libbeat/beat/event.go @@ -54,19 +54,6 @@ func (e *Event) SetID(id string) { e.Meta["_id"] = id } -func (e *Event) GetMetaStringValue(key string) (string, error) { - tmp, err := e.Meta.GetValue(key) - if err != nil { - return "", err - } - - if s, ok := tmp.(string); ok { - return s, nil - } - - return "", nil -} - func (e *Event) GetValue(key string) (interface{}, error) { if key == "@timestamp" { return e.Timestamp, nil diff --git a/libbeat/beat/events/optype.go b/libbeat/beat/events/optype.go new file mode 100644 index 00000000000..2ffb83d8f36 --- /dev/null +++ b/libbeat/beat/events/optype.go @@ -0,0 +1,28 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package events + +type OpType int + +//go:generate stringer -linecomment -type OpType +const ( + OpTypeDefault OpType = iota // + OpTypeCreate //create + OpTypeIndex // index + OpTypeDelete // delete +) diff --git a/libbeat/beat/events/optype_string.go b/libbeat/beat/events/optype_string.go new file mode 100644 index 00000000000..e13401c73cd --- /dev/null +++ b/libbeat/beat/events/optype_string.go @@ -0,0 +1,43 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +// Code generated by "stringer -linecomment -type OpType"; DO NOT EDIT. + +package events + +import "strconv" + +func _() { + // An "invalid array index" compiler error signifies that the constant values have changed. + // Re-run the stringer command to generate them again. + var x [1]struct{} + _ = x[OpTypeDefault-0] + _ = x[OpTypeCreate-1] + _ = x[OpTypeIndex-2] + _ = x[OpTypeDelete-3] +} + +const _OpType_name = "createindexdelete" + +var _OpType_index = [...]uint8{0, 0, 6, 11, 17} + +func (i OpType) String() string { + if i < 0 || i >= OpType(len(_OpType_index)-1) { + return "OpType(" + strconv.FormatInt(int64(i), 10) + ")" + } + return _OpType_name[_OpType_index[i]:_OpType_index[i+1]] +} diff --git a/libbeat/beat/events/util.go b/libbeat/beat/events/util.go new file mode 100644 index 00000000000..46967c82d71 --- /dev/null +++ b/libbeat/beat/events/util.go @@ -0,0 +1,84 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package events + +import "github.com/elastic/beats/v7/libbeat/beat" + +const ( + // FieldMetaID defines the ID for the event. Also see FieldMetaOpType. + FieldMetaID = "_id" + + // FieldMetaAlias defines the index alias to use for the event. If set, it takes + // precedence over values defined using FieldMetaIndex or FieldMetaRawIndex. + FieldMetaAlias = "alias" + + // FieldMetaIndex defines the base index name to use for the event. The value is suffixed + // with a Y-m-d value based on the event's timestamp. If set, it takes precedence over the + // value defined using FieldMetaRawIndex. + FieldMetaIndex = "index" + + // FieldMetaRawIndex defines the raw index name to use for the event. It is used as-is, without + // any additional manipulation. + FieldMetaRawIndex = "raw_index" + + // FieldMetaPipeline defines the ingest node pipeline to use for this event. + FieldMetaPipeline = "pipeline" + + // FieldMetaOpType defines the metadata key name for event operation type to use with the Elasticsearch + // Bulk API encoding of the event. The key's value can be an empty string, `create`, `index`, or `delete`. + // If empty, `create` will be used if FieldMetaID is set; otherwise `index` will be used. + FieldMetaOpType = "op_type" +) + +// GetMetaStringValue returns the value of the given event metadata string field +func GetMetaStringValue(e beat.Event, key string) (string, error) { + tmp, err := e.Meta.GetValue(key) + if err != nil { + return "", err + } + + if s, ok := tmp.(string); ok { + return s, nil + } + + return "", nil +} + +// GetOpType returns the event's op_type, if set +func GetOpType(e beat.Event) OpType { + tmp, err := e.Meta.GetValue(FieldMetaOpType) + if err != nil { + return OpTypeDefault + } + + switch v := tmp.(type) { + case OpType: + return v + case string: + switch v { + case "create": + return OpTypeCreate + case "index": + return OpTypeIndex + case "delete": + return OpTypeDelete + } + } + + return OpTypeDefault +} diff --git a/libbeat/beat/events/util_test.go b/libbeat/beat/events/util_test.go new file mode 100644 index 00000000000..d9c138130b7 --- /dev/null +++ b/libbeat/beat/events/util_test.go @@ -0,0 +1,90 @@ +// Licensed to Elasticsearch B.V. under one or more contributor +// license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright +// ownership. Elasticsearch B.V. licenses this file to you under +// the Apache License, Version 2.0 (the "License"); you may +// not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package events + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/common" +) + +func TestGetMetaStringValue(t *testing.T) { + tests := map[string]struct { + event beat.Event + metaFieldPath string + expectedValue string + expectedErr error + }{ + "nonexistent_field": { + beat.Event{ + Meta: common.MapStr{ + "foo": "bar", + }, + }, + "nonexistent", + "", + common.ErrKeyNotFound, + }, + "root": { + beat.Event{ + Meta: common.MapStr{ + "foo": "bar", + "baz": "hello", + }, + }, + "baz", + "hello", + nil, + }, + "nested": { + beat.Event{ + Meta: common.MapStr{ + "foo": "bar", + "baz": common.MapStr{ + "qux": "hello", + }, + }, + }, + "baz.qux", + "hello", + nil, + }, + "non_string": { + beat.Event{ + Meta: common.MapStr{ + "foo": "bar", + "baz": 17, + }, + }, + "baz", + "", + nil, + }, + } + + for name, test := range tests { + t.Run(name, func(t *testing.T) { + value, err := GetMetaStringValue(test.event, test.metaFieldPath) + require.Equal(t, test.expectedValue, value) + require.Equal(t, test.expectedErr, err) + }) + } +} diff --git a/libbeat/idxmgmt/std.go b/libbeat/idxmgmt/std.go index a6aff9af9d3..06a56646807 100644 --- a/libbeat/idxmgmt/std.go +++ b/libbeat/idxmgmt/std.go @@ -22,6 +22,7 @@ import ( "fmt" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/common/atomic" "github.com/elastic/beats/v7/libbeat/idxmgmt/ilm" @@ -352,28 +353,22 @@ func getEventCustomIndex(evt *beat.Event, beatInfo beat.Info) string { return "" } - if tmp := evt.Meta["alias"]; tmp != nil { - if alias, ok := tmp.(string); ok { - return alias - } + if alias, err := events.GetMetaStringValue(*evt, events.FieldMetaAlias); err == nil { + return alias } - if tmp := evt.Meta["index"]; tmp != nil { - if idx, ok := tmp.(string); ok { - ts := evt.Timestamp.UTC() - return fmt.Sprintf("%s-%d.%02d.%02d", - idx, ts.Year(), ts.Month(), ts.Day()) - } + if idx, err := events.GetMetaStringValue(*evt, events.FieldMetaIndex); err == nil { + ts := evt.Timestamp.UTC() + return fmt.Sprintf("%s-%d.%02d.%02d", + idx, ts.Year(), ts.Month(), ts.Day()) } // This is functionally identical to Meta["alias"], returning the overriding // metadata as the index name if present. It is currently used by Filebeat // to send the index for particular inputs to formatted string templates, // which are then expanded by a processor to the "raw_index" field. - if tmp := evt.Meta["raw_index"]; tmp != nil { - if idx, ok := tmp.(string); ok { - return idx - } + if idx, err := events.GetMetaStringValue(*evt, events.FieldMetaRawIndex); err == nil { + return idx } return "" diff --git a/libbeat/monitoring/report/elasticsearch/client.go b/libbeat/monitoring/report/elasticsearch/client.go index fb83a2e636b..e4f7bb50036 100644 --- a/libbeat/monitoring/report/elasticsearch/client.go +++ b/libbeat/monitoring/report/elasticsearch/client.go @@ -28,6 +28,7 @@ import ( "github.com/pkg/errors" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/esleg/eslegclient" "github.com/elastic/beats/v7/libbeat/logp" @@ -200,14 +201,14 @@ func (c *publishClient) publishBulk(ctx context.Context, event publisher.Event, meta["_type"] = "doc" } - action := common.MapStr{} - var opType string + opType := events.OpTypeCreate if esVersion.LessThan(createDocPrivAvailableESVersion) { - opType = "index" - } else { - opType = "create" + opType = events.OpTypeIndex + } + + action := common.MapStr{ + opType.String(): meta, } - action[opType] = meta event.Content.Fields.Put("timestamp", event.Content.Timestamp) diff --git a/libbeat/outputs/elasticsearch/client.go b/libbeat/outputs/elasticsearch/client.go index 706a92106c8..4a3c71df3bf 100644 --- a/libbeat/outputs/elasticsearch/client.go +++ b/libbeat/outputs/elasticsearch/client.go @@ -28,6 +28,7 @@ import ( "go.elastic.co/apm" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/esleg/eslegclient" "github.com/elastic/beats/v7/libbeat/logp" @@ -67,16 +68,8 @@ type bulkResultStats struct { const ( defaultEventType = "doc" - opTypeCreate = "create" - opTypeDelete = "delete" - opTypeIndex = "index" ) -// opTypeKey defines the metadata key name for event operation type. -// The key's value can be an empty string, `create`, `index`, or `delete`. If empty, it will assume -// either `create` or `index`. See `createEventBulkMeta`. If in doubt, set explicitly. -const opTypeKey = "op_type" - // NewClient instantiates a new client. func NewClient( s ClientSettings, @@ -289,7 +282,7 @@ func bulkEncodePublishRequest( log.Errorf("Failed to encode event meta data: %+v", err) continue } - if opType, err := event.GetMetaStringValue(opTypeKey); err == nil && opType == opTypeDelete { + if opType := events.GetOpType(*event); opType == events.OpTypeDelete { // We don't include the event source in a bulk DELETE bulkItems = append(bulkItems, meta) } else { @@ -324,8 +317,8 @@ func createEventBulkMeta( return nil, err } - id, _ := event.GetMetaStringValue("_id") - opType, _ := event.GetMetaStringValue(opTypeKey) + id, _ := events.GetMetaStringValue(*event, events.FieldMetaID) + opType := events.GetOpType(*event) meta := eslegclient.BulkMeta{ Index: index, @@ -334,15 +327,15 @@ func createEventBulkMeta( ID: id, } - if opType == opTypeDelete { + if opType == events.OpTypeDelete { if id != "" { return eslegclient.BulkDeleteAction{Delete: meta}, nil } else { - return nil, fmt.Errorf("%s %s requires _id", opTypeKey, opTypeDelete) + return nil, fmt.Errorf("%s %s requires _id", events.FieldMetaOpType, events.OpTypeDelete) } } if id != "" || version.Major > 7 || (version.Major == 7 && version.Minor >= 5) { - if opType == opTypeIndex { + if opType == events.OpTypeIndex { return eslegclient.BulkIndexAction{Index: meta}, nil } return eslegclient.BulkCreateAction{Create: meta}, nil @@ -352,12 +345,15 @@ func createEventBulkMeta( func getPipeline(event *beat.Event, pipelineSel *outil.Selector) (string, error) { if event.Meta != nil { - if pipeline, exists := event.Meta["pipeline"]; exists { - if p, ok := pipeline.(string); ok { - return p, nil - } + pipeline, err := events.GetMetaStringValue(*event, events.FieldMetaPipeline) + if err == common.ErrKeyNotFound { + return "", nil + } + if err != nil { return "", errors.New("pipeline metadata is no string") } + + return pipeline, nil } if pipelineSel != nil { diff --git a/libbeat/outputs/elasticsearch/client_test.go b/libbeat/outputs/elasticsearch/client_test.go index 125105ea69b..db152bf9045 100644 --- a/libbeat/outputs/elasticsearch/client_test.go +++ b/libbeat/outputs/elasticsearch/client_test.go @@ -32,6 +32,7 @@ import ( "github.com/stretchr/testify/require" "github.com/elastic/beats/v7/libbeat/beat" + e "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/esleg/eslegclient" "github.com/elastic/beats/v7/libbeat/idxmgmt" @@ -321,12 +322,12 @@ func TestBulkEncodeEvents(t *testing.T) { func TestBulkEncodeEventsWithOpType(t *testing.T) { cases := []common.MapStr{ - {"_id": "111", "op_type": "index", "message": "test 1", "bulkIndex": 0}, - {"_id": "112", "op_type": "", "message": "test 2", "bulkIndex": 2}, - {"_id": "", "op_type": "delete", "message": "test 6", "bulkIndex": -1}, // this won't get encoded due to missing _id - {"_id": "", "op_type": "", "message": "test 3", "bulkIndex": 4}, - {"_id": "114", "op_type": "delete", "message": "test 4", "bulkIndex": 6}, - {"_id": "115", "op_type": "index", "message": "test 5", "bulkIndex": 7}, + {"_id": "111", "op_type": e.OpTypeIndex, "message": "test 1", "bulkIndex": 0}, + {"_id": "112", "message": "test 2", "bulkIndex": 2}, + {"_id": "", "op_type": e.OpTypeDelete, "message": "test 6", "bulkIndex": -1}, // this won't get encoded due to missing _id + {"_id": "", "message": "test 3", "bulkIndex": 4}, + {"_id": "114", "op_type": e.OpTypeDelete, "message": "test 4", "bulkIndex": 6}, + {"_id": "115", "op_type": e.OpTypeIndex, "message": "test 5", "bulkIndex": 7}, } cfg := common.MustNewConfigFrom(common.MapStr{}) @@ -343,16 +344,21 @@ func TestBulkEncodeEventsWithOpType(t *testing.T) { events := make([]publisher.Event, len(cases)) for i, fields := range cases { + meta := common.MapStr{ + "_id": fields["_id"], + } + if opType, exists := fields["op_type"]; exists { + meta[e.FieldMetaOpType] = opType + } + events[i] = publisher.Event{ Content: beat.Event{ - Meta: common.MapStr{ - "_id": fields["_id"], - "op_type": fields["op_type"], - }, + Meta: meta, Fields: common.MapStr{ "message": fields["message"], }, - }} + }, + } } encoded, bulkItems := bulkEncodePublishRequest(logp.L(), *common.MustNewVersion(version.GetDefaultVersion()), index, pipeline, events) @@ -364,16 +370,16 @@ func TestBulkEncodeEventsWithOpType(t *testing.T) { if bulkEventIndex == -1 { continue } - caseOpType, _ := cases[i]["op_type"].(string) + caseOpType, _ := cases[i]["op_type"] caseMessage, _ := cases[i]["message"].(string) switch bulkItems[bulkEventIndex].(type) { case eslegclient.BulkCreateAction: - validOpTypes := []string{opTypeCreate, ""} + validOpTypes := []interface{}{e.OpTypeCreate, nil} require.Contains(t, validOpTypes, caseOpType, caseMessage) case eslegclient.BulkIndexAction: - require.Equal(t, opTypeIndex, caseOpType, caseMessage) + require.Equal(t, e.OpTypeIndex, caseOpType, caseMessage) case eslegclient.BulkDeleteAction: - require.Equal(t, opTypeDelete, caseOpType, caseMessage) + require.Equal(t, e.OpTypeDelete, caseOpType, caseMessage) default: require.FailNow(t, "unknown type") } diff --git a/libbeat/processors/actions/decode_json_fields.go b/libbeat/processors/actions/decode_json_fields.go index b9ea3440db9..f0e3db61b3e 100644 --- a/libbeat/processors/actions/decode_json_fields.go +++ b/libbeat/processors/actions/decode_json_fields.go @@ -26,6 +26,7 @@ import ( "github.com/pkg/errors" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/common/jsontransform" "github.com/elastic/beats/v7/libbeat/logp" @@ -159,7 +160,7 @@ func (f *decodeJSONFields) Run(event *beat.Event) (*beat.Event, error) { if event.Meta == nil { event.Meta = common.MapStr{} } - event.Meta["_id"] = id + event.Meta[events.FieldMetaID] = id } } diff --git a/libbeat/processors/add_formatted_index/add_formatted_index.go b/libbeat/processors/add_formatted_index/add_formatted_index.go index 72be2a89775..bd4e542b14f 100644 --- a/libbeat/processors/add_formatted_index/add_formatted_index.go +++ b/libbeat/processors/add_formatted_index/add_formatted_index.go @@ -21,6 +21,7 @@ import ( "fmt" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/common/fmtstr" ) @@ -48,7 +49,7 @@ func (p *AddFormattedIndex) Run(event *beat.Event) (*beat.Event, error) { if event.Meta == nil { event.Meta = common.MapStr{} } - event.Meta["raw_index"] = index + event.Meta[events.FieldMetaRawIndex] = index return event, nil } diff --git a/libbeat/processors/script/javascript/beatevent_v0_test.go b/libbeat/processors/script/javascript/beatevent_v0_test.go index 030a260d424..5d77e802a1b 100644 --- a/libbeat/processors/script/javascript/beatevent_v0_test.go +++ b/libbeat/processors/script/javascript/beatevent_v0_test.go @@ -26,6 +26,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/monitoring" "github.com/elastic/beats/v7/libbeat/tests/resources" @@ -128,7 +129,7 @@ var eventV0Tests = []testCase{ name: "Delete @metadata", source: `evt.Delete("@metadata.pipeline");`, assert: func(t testing.TB, evt *beat.Event, err error) { - assert.Nil(t, evt.Meta["pipeline"]) + assert.Nil(t, evt.Meta[events.FieldMetaPipeline]) }, }, { diff --git a/metricbeat/mb/event_test.go b/metricbeat/mb/event_test.go index 3de07034fca..50d6857c777 100644 --- a/metricbeat/mb/event_test.go +++ b/metricbeat/mb/event_test.go @@ -26,6 +26,7 @@ import ( "github.com/stretchr/testify/assert" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" ) @@ -139,7 +140,7 @@ func TestEventConversionToBeatEvent(t *testing.T) { e := mbEvent.BeatEvent(module, metricSet) e = mbEvent.BeatEvent(module, metricSet) - assert.Equal(t, "foobar", e.Meta["_id"]) + assert.Equal(t, "foobar", e.Meta[events.FieldMetaID]) assert.Equal(t, timestamp, e.Timestamp) assert.Equal(t, common.MapStr{ "type": "docker", diff --git a/x-pack/functionbeat/function/beater/proccessors_test.go b/x-pack/functionbeat/function/beater/proccessors_test.go index 3a18aa82b02..c38649fe2e2 100644 --- a/x-pack/functionbeat/function/beater/proccessors_test.go +++ b/x-pack/functionbeat/function/beater/proccessors_test.go @@ -12,6 +12,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/elastic/beats/v7/libbeat/beat" + "github.com/elastic/beats/v7/libbeat/beat/events" "github.com/elastic/beats/v7/libbeat/common" "github.com/elastic/beats/v7/libbeat/processors" _ "github.com/elastic/beats/v7/libbeat/processors/actions" @@ -123,7 +124,7 @@ func (p *setRawIndex) Run(event *beat.Event) (*beat.Event, error) { if event.Meta == nil { event.Meta = common.MapStr{} } - event.Meta["raw_index"] = p.indexStr + event.Meta[events.FieldMetaRawIndex] = p.indexStr return event, nil }