From 3b8817fd4dfb4c0bf7235184cfd2e0bc2ab354a5 Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Mon, 18 Mar 2019 19:04:29 +0100 Subject: [PATCH 1/2] Don't collect empty ip addresses in docker container metricset (#11247) Docker containers can have empty ip addresses if they are running in host network mode or if they are stopped. Collecting lists with empty addresses can make type mapping to fail when trying to store them as ip addresses. Fix #11225 (cherry picked from commit 258c1c8419ec945967f8a9e8e9d92e166f0bb3f7) --- CHANGELOG.next.asciidoc | 3 +++ metricbeat/module/docker/container/data.go | 4 +++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 645f3d09b9fc..3d9732300e23 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -72,6 +72,9 @@ https://github.com/elastic/beats/compare/v7.0.0-beta1...master[Check the HEAD di - Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. {pull}10916[10916] - Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] - Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test +- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test case. {issue}11004[11004] {pull}11105[11105] +- Fix issue preventing docker container events to be stored if the container has a network interface without ip address. {issue}11225[11225] {pull}11247[11247] +- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test case. {issue}11004[11004] {pull}11105[11105] - Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252] - Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256] diff --git a/metricbeat/module/docker/container/data.go b/metricbeat/module/docker/container/data.go index c0bb07518faf..838291a751bf 100644 --- a/metricbeat/module/docker/container/data.go +++ b/metricbeat/module/docker/container/data.go @@ -71,7 +71,9 @@ func eventMapping(r mb.ReporterV2, cont *types.Container, dedot bool) { func extractIPAddresses(networks *types.SummaryNetworkSettings) []string { ipAddresses := make([]string, 0, len(networks.Networks)) for _, network := range networks.Networks { - ipAddresses = append(ipAddresses, network.IPAddress) + if len(network.IPAddress) > 0 { + ipAddresses = append(ipAddresses, network.IPAddress) + } } return ipAddresses } From 6691d3ae1039d7652429d6dfd682ae59db8e4b5e Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Tue, 19 Mar 2019 12:41:03 +0100 Subject: [PATCH 2/2] Fix changelog --- CHANGELOG.next.asciidoc | 3 --- 1 file changed, 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 3d9732300e23..41659c1de1d5 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -71,11 +71,8 @@ https://github.com/elastic/beats/compare/v7.0.0-beta1...master[Check the HEAD di - Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. {pull}10916[10916] - Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] -- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test - Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test case. {issue}11004[11004] {pull}11105[11105] - Fix issue preventing docker container events to be stored if the container has a network interface without ip address. {issue}11225[11225] {pull}11247[11247] -- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test - case. {issue}11004[11004] {pull}11105[11105] - Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252] - Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256]