Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Packetbeat] Add forwarded tag example to config for network tap #19209

Merged
merged 2 commits into from
Jun 25, 2020
Merged

[Packetbeat] Add forwarded tag example to config for network tap #19209

merged 2 commits into from
Jun 25, 2020

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented Jun 16, 2020 •
edited
Loading

What does this PR do?

Add an example to packetbeat.yml of using the forwarded tag to disable host metadata fields when processing network data from network tap or mirror port.

With the default config you simply add

tags: [forwarded]

and the processors will remove host.* (and not include add_host_metadata).

Why is it important?

For users collecting monitoring a network tap or mirror port its important to not include the host fields in events because this traffic did not originate on the Packetbeat host.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jun 16, 2020
@andrewkroh andrewkroh force-pushed the feature/pb/disable-host branch from 3d815cf to d2bb348 Compare June 16, 2020 00:41
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jun 16, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #19209 updated]

  • Start Time: 2020-06-18T21:07:13.061+0000

  • Duration: 43 min 31 sec

Test stats 🧪

Test Results
Failed 0
Passed 718
Skipped 128
Total 846

@andrewkroh
Add forwarded tag example to packetbeat.yml
f055de9 
Add an example to packetbeat.yml of using the `forwarded` tag to disable `host` metadata fields when processing network data from network tap or mirror port.

Relates elastic#13920
@andrewkroh andrewkroh force-pushed the feature/pb/disable-host branch from d2bb348 to f055de9 Compare June 16, 2020 00:43
@andrewkroh andrewkroh marked this pull request as ready for review June 16, 2020 13:38
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@andrewkroh andrewkroh merged commit 28cb613 into elastic:master Jun 25, 2020
@andrewkroh andrewkroh added the needs_backport PR is waiting to be backported to other branches. label Jul 29, 2020
@andrewkroh andrewkroh mentioned this pull request Jul 29, 2020
Merged
6 tasks
@andrewkroh andrewkroh added v7.10.0 and removed needs_backport PR is waiting to be backported to other branches. labels Jul 29, 2020
andrewkroh added a commit to andrewkroh/beats that referenced this pull request Jul 29, 2020
@andrewkroh
Add forwarded tag example to packetbeat.yml (elastic#19209)
70a2860 
Add an example to packetbeat.yml of using the `forwarded` tag to disable `host` metadata fields when processing network data from network tap or mirror port.

Relates elastic#13920

(cherry picked from commit 28cb613)
andrewkroh added a commit that referenced this pull request Jul 29, 2020
@andrewkroh
Add forwarded tag example to packetbeat.yml (#19209) (#20309)
c76d2c1 
Add an example to packetbeat.yml of using the `forwarded` tag to disable `host` metadata fields when processing network data from network tap or mirror port.

Relates #13920

(cherry picked from commit 28cb613)
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@andrewkroh @melchiormoulin
Add forwarded tag example to packetbeat.yml (elastic#19209)
c29f1d4 
Add an example to packetbeat.yml of using the `forwarded` tag to disable `host` metadata fields when processing network data from network tap or mirror port.

Relates elastic#13920
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@leehinman leehinman leehinman approved these changes

Assignees
No one assigned
Labels
Packetbeat review v7.10.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@andrewkroh @elasticmachine @leehinman