Code

[Filebeat] Add Shorewall module#12199

Code

Closed

mdelapenya wants to merge 34 commits intoelastic:masterelastic/beats:masterfrom mdelapenya:shorewall-modulemdelapenya/beats:shorewall-moduleCopy head branch name to clipboard

+3,631

Commits

Commits on May 20, 2019

• Shorewall module: Initial commit

  Show description for 7bcdf53
  mdelapenya

  committed
  7bcdf53

• Run 'make create-fileset MODULE=shorewall FILESET=log' to initialise the file to parse (the shorewall log)

  mdelapenya

  committed
  5385157

• Define GROK expression to parse Shorewall

  Show description for a0c8545
  mdelapenya

  committed
  a0c8545

• Update default file to parse

  mdelapenya

  committed
  4d22a58

• Add shorewall log example for tests

  mdelapenya

  committed
  98904d9

• Add expected JSON after running tests

  Show description for e4282d2
  mdelapenya

  committed
  e4282d2

• Use grok expression instead of its grok word

  Show description for 0359a79
  mdelapenya

  committed
  0359a79

• Convert one field (nf_src_port) to integer

  mdelapenya

  committed
  1754755

• Update expected test output after running tests

  Show description for 41c8c0c
  mdelapenya

  committed
  41c8c0c

• Convert all integer fields

  mdelapenya

  committed
  4fc87ec

• Convert timestamp field into Elasticsearch's @timestamp identifier

  Show description for c565d6d
  mdelapenya

  committed
  c565d6d

• Remove old timestamp field in favour of ES's defaults @timestamp

  mdelapenya

  committed
  fd1fd04

• Update expected log for timestamp

  mdelapenya

  committed
  9b4518f

• Use sneakcase for fields

  mdelapenya

  committed
  624078e

• Use Elastic Common Schema (ECS) for existing fields

  mdelapenya

  committed
  2bc9ca4

• Update action fields to denote they are shorewall specifics

  mdelapenya

  committed
  3a899dd

• Move field documentation to the proper location: the fileset

  mdelapenya

  committed
  037c84d

• Remove ECS fields from docs, are they are not needed

  mdelapenya

  committed
  e55ad2c

• Use proper shared field definition for shorewall

  Show description for 329ca15
  mdelapenya

  committed
  329ca15

• Use Elastic Common Schema (ECS) for more fields

  mdelapenya

  committed
  ff07455

• Represent shorewall specific fields using dot notation for children elements

  mdelapenya

  committed
  5c01192

• Update expected log after tests run

  mdelapenya

  committed
  0359d43

• Use proper type for LEN field

  Show description for 8e5cc48
  mdelapenya

  committed
  8e5cc48

• Run "make update" to autogenerate docs for fields

  Show description for 007b0cb
  mdelapenya

  committed
  007b0cb

• Run "make update" from OSS directory to autogenerate docs for fields, include new module into the existing list of Filebeat modules

  mdelapenya

  committed
  e0deca0

• Move specific log fields to the parent level

  Show description for db763af
  mdelapenya

  committed
  db763af

Commits on May 21, 2019

• Add more log examples from a real firewall

  mdelapenya

  committed
  0535c39

• Improve patterns covering the new file

  mdelapenya

  committed
  63dbeda

• List new fields into the docs

  mdelapenya

  committed
  cea3267

• Update expected log for tests

  mdelapenya

  committed
  b13e4a6

• Document fields with "make update"

  Show description for c7cb5c9
  mdelapenya

  committed
  c7cb5c9

• Remove path for Darwin and Windows

  mdelapenya

  committed
  b178dcf

• Use Shorewall zone fields

  mdelapenya

  committed
  5f84a65

• Set UTC timezone when configuring @timestamp

  mdelapenya

  committed
  146485d