Fix fortinet.firewall.mem value to be interpreted as integer (#19335) (…

…#20542) Fix fortinet.firewall.mem value to be interpreted as integer. Add convert processor for fortinet.firewall.mem to ingest pipeline. Closes #19327 Co-authored-by: Andrew Kroh <[email protected]> (cherry picked from commit e7c0b1d) Co-authored-by: Philipp Kahr <[email protected]>
elastic · Aug 11, 2020 · 9a3bef6 · 9a3bef6
1 parent 2e2af60
commit 9a3bef6
Show file tree

Hide file tree

Showing 6 changed files with 10 additions and 4 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -206,6 +206,7 @@ field. You can revert this change by configuring tags for the module and omittin
 - netflow: Fix bytes/packets counters on some devices (NSEL and Netstream). {pull}15449[15449]
 - netflow: Fix compatibility with some Cisco devices by changing the field `class_id` from short to long. {pull}15449[15449]
 - Fixed dashboard for Cisco ASA Firewall. {issue}15420[15420] {pull}15553[15553]
+- Fix mapping of fortinet.firewall.mem as integer. {pull}19335[19335]
 - Ensure all zeek timestamps include millisecond precision. {issue}14599[14599] {pull}16766[16766]
 - Fix s3 input hanging with GetObjectRequest API call by adding context_timeout config. {issue}15502[15502] {pull}15590[15590]
 - Add shared_credential_file to cloudtrail config {issue}15652[15652] {pull}15656[15656]

diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
@@ -59145,7 +59145,7 @@ type: integer
 Memory usage system statistics
 
 
-type: keyword
+type: integer
 
 --
 

diff --git a/x-pack/filebeat/module/fortinet/fields.go b/x-pack/filebeat/module/fortinet/fields.go
diff --git a/x-pack/filebeat/module/fortinet/firewall/_meta/fields.yml b/x-pack/filebeat/module/fortinet/firewall/_meta/fields.yml
@@ -1126,7 +1126,7 @@
             Fabric medium count
 
         - name: mem
-          type: keyword
+          type: integer
           description: >
             Memory usage system statistics
 

diff --git a/x-pack/filebeat/module/fortinet/firewall/ingest/event.yml b/x-pack/filebeat/module/fortinet/firewall/ingest/event.yml
@@ -218,6 +218,11 @@ processors:
     ignore_failure: true
     ignore_missing: true
     if: "ctx.event?.duration == null"
+- convert:
+    field: fortinet.firewall.mem
+    type: integer
+    ignore_failure: true
+    ignore_missing: true
 - geoip:
     field: source.ip
     target_field: source.geo

diff --git a/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json b/x-pack/filebeat/module/fortinet/firewall/test/fortinet.log-expected.json
@@ -973,7 +973,7 @@
         "fortinet.firewall.disklograte": "0",
         "fortinet.firewall.fazlograte": "0",
         "fortinet.firewall.freediskstorage": "331",
-        "fortinet.firewall.mem": "10",
+        "fortinet.firewall.mem": 10,
         "fortinet.firewall.setuprate": "0",
         "fortinet.firewall.subtype": "system",
         "fortinet.firewall.sysuptime": "25170",
-Original file line number
+Diff line change
@@ Expand Up / @@ -59145,7 +59145,7 @@ type: integer @@
     Memory usage system statistics
-    type: keyword
+    type: integer
     --
@@ Expand Down @@