-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add on_failure handler for Zeek ingest pipelines. Fix one field name #11105
Conversation
alakahakai
commented
Mar 6, 2019
- Address issue 11004 - Add on_failure handler for Zeek ingest pipelines.
- Fix one field name error for notice and add an additional test
…error for notice and add an additional test
Pinging @elastic/secops |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Two minor things to 👀
CHANGELOG.next.asciidoc
Outdated
@@ -161,6 +161,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d | |||
- Improve detection of file deletion on Windows. {pull}10747[10747] | |||
- Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. {pull}10916[10916] | |||
- Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] | |||
- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test | |||
case. {{issue}11004[11004] pull}11105[11105] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Check out your asciidoc links here ;-)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
case. {{issue}11004[11004] pull}11105[11105] | |
case. {issue}11004[11004] {pull}11105[11105] |
@@ -0,0 +1,21 @@ | |||
# Module: zeek | |||
# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-zeek.html |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should we use /current/
instead of /master/
here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think these headers are generated based on the documentation branch which is master so this is correct.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM (minus the changelog). Thanks for adding these. I ran into the problem when I accidentally appended a blank line to my log file and filebeat stopped ingesting.
@@ -0,0 +1,21 @@ | |||
# Module: zeek | |||
# Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-zeek.html |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think these headers are generated based on the documentation branch which is master so this is correct.
CHANGELOG.next.asciidoc
Outdated
@@ -161,6 +161,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d | |||
- Improve detection of file deletion on Windows. {pull}10747[10747] | |||
- Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. {pull}10916[10916] | |||
- Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] | |||
- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test | |||
case. {{issue}11004[11004] pull}11105[11105] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
case. {{issue}11004[11004] pull}11105[11105] | |
case. {issue}11004[11004] {pull}11105[11105] |