[Filebeat] Remove alias fields from Suricata and Traefik module mappi…

…ngs (#26627)

* Remove alias fields from Suricata/Traefik module mappings

Alias fields are displayed in Kibana whenever their target exists in a document. This yields
confusing results when, for example, you are looking at Zeek module events but see many
`suricata.eve.*` fields just because Zeek populates many ECS fields.

This is a breaking change for users that depend on the Suricata alias fields. Because these
alias cause issues for all users I think it best to remove them.

The following alias fields are removed:

suricata.eve.fileinfo.filename
suricata.eve.fileinfo.size
suricata.eve.dest_port
suricata.eve.src_port
suricata.eve.proto
suricata.eve.src_ip
suricata.eve.dest_ip
suricata.eve.http.status
suricata.eve.http.http_user_agent
suricata.eve.http.http_refer
suricata.eve.http.url
suricata.eve.http.hostname
suricata.eve.http.http_refer
suricata.eve.http.url
suricata.eve.http.hostname
suricata.eve.http.length
suricata.eve.http.http_method
suricata.eve.alert.severity
suricata.eve.alert.action
suricata.eve.flow.bytes_toclient
suricata.eve.flow.start
suricata.eve.flow.pkts_toclient
suricata.eve.flow.bytes_toserver
suricata.eve.flow.pkts_toserver
suricata.eve.app_proto
traefik.access.user_agent.device

Relates: #10535

* Fix changelog

(cherry picked from commit 877ae2c)

CHANGELOG.next.asciidoc

@@ -80,6 +80,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Change source field for `event.action` in `fortinet.firewall` module to `fortinet.firewall.action` instead of `fortinet.firewall.eventtype`. {pull}24816[24816]
 - Release Filebeat Stack Monitoring modules as GA {pull}26226[26226]
 - threatintel module: Changed the type of `threatintel.indicator.first_seen` from `keyword` to `date`. {pull}26765[26765]
+- Remove all alias fields pointing to ECS fields from modules. This affects the Suricata and Traefik modules. {issue}10535[10535] {pull}26627[26627]
 
 *Heartbeat*
 - Add support for screenshot blocks and use newer synthetics flags that only works in newer synthetics betas. {pull}25808[25808]

filebeat/docs/fields.asciidoc

@@ -143909,15 +143909,6 @@ type: keyword
 
 --
 
-*`suricata.eve.fileinfo.filename`*::
-+
---
-type: alias
-
-alias to: file.path
-
---
-
 *`suricata.eve.fileinfo.tx_id`*::
 +
 --
@@ -143960,65 +143951,20 @@ type: keyword
 
 --
 
-*`suricata.eve.fileinfo.size`*::
-+
---
-type: alias
-
-alias to: file.size
-
---
-
 *`suricata.eve.icmp_type`*::
 +
 --
 type: long
 
 --
 
-*`suricata.eve.dest_port`*::
-+
---
-type: alias
-
-alias to: destination.port
-
---
-
-*`suricata.eve.src_port`*::
-+
---
-type: alias
-
-alias to: source.port
-
---
-
-*`suricata.eve.proto`*::
-+
---
-type: alias
-
-alias to: network.transport
-
---
-
 *`suricata.eve.pcap_cnt`*::
 +
 --
 type: long
 
 --
 
-*`suricata.eve.src_ip`*::
-+
---
-type: alias
-
-alias to: source.ip
-
---
-
 
 *`suricata.eve.dns.type`*::
 +
@@ -144091,15 +144037,6 @@ type: keyword
 
 --
 
-*`suricata.eve.dest_ip`*::
-+
---
-type: alias
-
-alias to: destination.ip
-
---
-
 *`suricata.eve.icmp_code`*::
 +
 --
@@ -144108,83 +144045,20 @@ type: long
 --
 
 
-*`suricata.eve.http.status`*::
-+
---
-type: alias
-
-alias to: http.response.status_code
-
---
-
 *`suricata.eve.http.redirect`*::
 +
 --
 type: keyword
 
 --
 
-*`suricata.eve.http.http_user_agent`*::
-+
---
-type: alias
-
-alias to: user_agent.original
-
---
-
 *`suricata.eve.http.protocol`*::
 +
 --
 type: keyword
 
 --
 
-*`suricata.eve.http.http_refer`*::
-+
---
-type: alias
-
-alias to: http.request.referrer
-
---
-
-*`suricata.eve.http.url`*::
-+
---
-type: alias
-
-alias to: url.original
-
---
-
-*`suricata.eve.http.hostname`*::
-+
---
-type: alias
-
-alias to: url.domain
-
---
-
-*`suricata.eve.http.length`*::
-+
---
-type: alias
-
-alias to: http.response.body.bytes
-
---
-
-*`suricata.eve.http.http_method`*::
-+
---
-type: alias
-
-alias to: http.request.method
-
---
-
 *`suricata.eve.http.http_content_type`*::
 +
 --
@@ -144216,15 +144090,6 @@ type: keyword
 
 --
 
-*`suricata.eve.alert.severity`*::
-+
---
-type: alias
-
-alias to: event.severity
-
---
-
 *`suricata.eve.alert.rev`*::
 +
 --
@@ -144246,15 +144111,6 @@ type: keyword
 
 --
 
-*`suricata.eve.alert.action`*::
-+
---
-type: alias
-
-alias to: event.outcome
-
---
-
 *`suricata.eve.alert.signature_id`*::
 +
 --
@@ -145401,33 +145257,6 @@ type: keyword
 --
 
 
-*`suricata.eve.flow.bytes_toclient`*::
-+
---
-type: alias
-
-alias to: destination.bytes
-
---
-
-*`suricata.eve.flow.start`*::
-+
---
-type: alias
-
-alias to: event.start
-
---
-
-*`suricata.eve.flow.pkts_toclient`*::
-+
---
-type: alias
-
-alias to: destination.packets
-
---
-
 *`suricata.eve.flow.age`*::
 +
 --
@@ -145442,47 +145271,20 @@ type: keyword
 
 --
 
-*`suricata.eve.flow.bytes_toserver`*::
-+
---
-type: alias
-
-alias to: source.bytes
-
---
-
 *`suricata.eve.flow.reason`*::
 +
 --
 type: keyword
 
 --
 
-*`suricata.eve.flow.pkts_toserver`*::
-+
---
-type: alias
-
-alias to: source.packets
-
---
-
 *`suricata.eve.flow.alerted`*::
 +
 --
 type: boolean
 
 --
 
-*`suricata.eve.app_proto`*::
-+
---
-type: alias
-
-alias to: network.protocol
-
---
-
 *`suricata.eve.tx_id`*::
 +
 --
@@ -153375,15 +153177,6 @@ alias to: user_agent.original
 --
 
 
-*`traefik.access.user_agent.device`*::
-+
---
-type: alias
-
-alias to: user_agent.device.name
-
---
-
 *`traefik.access.user_agent.name`*::
 +
 --

filebeat/module/traefik/access/_meta/fields.yml

@@ -60,9 +60,6 @@
     - name: user_agent
       type: group
       fields:
-        - name: device
-          type: alias
-          path: user_agent.device.name
         - name: name
           type: alias
           path: user_agent.name