Skip to content

Commit

Permalink
Fix source.address not being set for nginx ingress_controller (#18511)
Browse files Browse the repository at this point in the history 
Signed-off-by: chrismark <[email protected]>
Co-authored-by: chendo <[email protected]>
  • Loading branch information
@ChrsMark @chendo
ChrsMark and chendo authored May 15, 2020
1 parent e990740 commit 8e29ab7
Show file tree
Hide file tree
Showing 3 changed files with 112 additions and 23 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.next.asciidoc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -140,6 +140,7 @@ field. You can revert this change by configuring tags for the module and omittin
- Fix Cisco ASA ASA 3020** and 106023 messages {pull}17964[17964]
- Unescape file name from SQS message. {pull}18370[18370]
- Improve cisco asa and ftd pipelines' failure handler to avoid mapping temporary fields. {issue}18391[18391] {pull}18392[18392]
- Fix source.address not being set for nginx ingress_controller {pull}18511[18511]
- Fix PANW module wrong mappings for bytes and packets counters. {issue}18522[18522] {pull}18525[18525]
- Fixed ingestion of some Cisco ASA and FTD messages when a hostname was used instead of an IP for NAT fields. {issue}14034[14034] {pull}18376[18376]
- Fix a rate limit related issue in httpjson input for Okta module. {issue}18530[18530] {pull}18534[18534]
Expand Down
2 changes: 1 addition & 1 deletion filebeat/module/nginx/ingress_controller/ingest/pipeline.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ processors:
if: ctx.source?.address == null
value: ""
- script:
if: ctx.nginx?.access?.remote_ip_list != null && ctx.nginx.ingress_controller.remote_ip_list.length > 0
if: ctx.nginx?.ingress_controller?.remote_ip_list != null && ctx.nginx.ingress_controller.remote_ip_list.length > 0
lang: painless
source: >-
boolean isPrivate(def dot, def ip) {
Expand Down
132 changes: 110 additions & 22 deletions filebeat/module/nginx/ingress_controller/test/test.log-expected.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products",
"user_agent.device.name": "Other",
"user_agent.name": "curl",
Expand Down Expand Up @@ -73,8 +77,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42",
"user_agent.device.name": "Other",
"user_agent.name": "curl",
Expand Down Expand Up @@ -114,8 +122,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.001,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42",
"user_agent.device.name": "Other",
"user_agent.name": "curl",
Expand Down Expand Up @@ -155,8 +167,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42",
"user_agent.device.name": "Other",
"user_agent.name": "curl",
Expand Down Expand Up @@ -191,8 +207,12 @@
],
"nginx.ingress_controller.upstream.alternative_name": "",
"nginx.ingress_controller.upstream.name": "",
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42"
},
{
Expand Down Expand Up @@ -223,8 +243,12 @@
],
"nginx.ingress_controller.upstream.alternative_name": "",
"nginx.ingress_controller.upstream.name": "",
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42"
},
{
Expand Down Expand Up @@ -260,8 +284,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42",
"user_agent.device.name": "Other",
"user_agent.name": "Wget",
Expand Down Expand Up @@ -301,8 +329,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42",
"user_agent.device.name": "Other",
"user_agent.name": "Chrome",
Expand Down Expand Up @@ -346,8 +378,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/favicon.ico",
"user_agent.device.name": "Other",
"user_agent.name": "Chrome",
Expand Down Expand Up @@ -390,8 +426,12 @@
"nginx.ingress_controller.upstream.response.length": 61,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.001,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/v2",
"user_agent.device.name": "Other",
"user_agent.name": "Chrome",
Expand Down Expand Up @@ -435,8 +475,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.002,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/favicon.ico",
"user_agent.device.name": "Other",
"user_agent.name": "Chrome",
Expand Down Expand Up @@ -479,8 +523,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.001,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42",
"user_agent.device.name": "Other",
"user_agent.name": "Safari",
Expand Down Expand Up @@ -524,8 +572,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.001,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/favicon.ico",
"user_agent.device.name": "Other",
"user_agent.name": "Safari",
Expand Down Expand Up @@ -568,8 +620,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.002,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42",
"user_agent.device.name": "Other",
"user_agent.name": "Safari",
Expand Down Expand Up @@ -612,8 +668,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.001,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/",
"user_agent.device.name": "Other",
"user_agent.name": "Safari",
Expand Down Expand Up @@ -657,8 +717,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.002,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/favicon.ico",
"user_agent.device.name": "Other",
"user_agent.name": "Safari",
Expand Down Expand Up @@ -701,8 +765,12 @@
"nginx.ingress_controller.upstream.response.length": 61,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.002,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/v2",
"user_agent.device.name": "Other",
"user_agent.name": "Safari",
Expand Down Expand Up @@ -746,8 +814,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/favicon.ico",
"user_agent.device.name": "Other",
"user_agent.name": "Safari",
Expand Down Expand Up @@ -790,8 +862,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.001,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/products/42?address=delhi+technological+university",
"user_agent.device.name": "Other",
"user_agent.name": "Python Requests",
Expand Down Expand Up @@ -831,8 +907,12 @@
"nginx.ingress_controller.upstream.response.length": 61,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.001,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/v2",
"user_agent.device.name": "Other",
"user_agent.name": "Firefox",
Expand Down Expand Up @@ -875,8 +955,12 @@
"nginx.ingress_controller.upstream.response.length": 59,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/favicon.ico",
"user_agent.device.name": "Other",
"user_agent.name": "Firefox",
Expand Down Expand Up @@ -919,8 +1003,12 @@
"nginx.ingress_controller.upstream.response.length": 61,
"nginx.ingress_controller.upstream.response.status_code": 200,
"nginx.ingress_controller.upstream.response.time": 0.0,
"related.ip": [
"192.168.64.1"
],
"service.type": "nginx",
"source.address": "",
"source.address": "192.168.64.1",
"source.ip": "192.168.64.1",
"url.original": "/v2/some",
"user_agent.device.name": "Other",
"user_agent.name": "Firefox",
Expand Down

0 comments on commit 8e29ab7

Please sign in to comment.