-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Agent: populate action_input_type for the .fleet-actions-results #30562
Agent: populate action_input_type for the .fleet-actions-results #30562
Conversation
This pull request does not have a backport label. Could you fix it @aleksmaus? 🙏
NOTE: |
Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane) |
@@ -114,6 +114,7 @@ func constructEvent(action fleetapi.Action, agentID string) fleetapi.AckEvent { | |||
} | |||
|
|||
if a, ok := action.(*fleetapi.ActionApp); ok { | |||
ackev.InputType = a.InputType |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there any unit tests for this path? Would be great to add a test for this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
… simplify them and eliminate the go routines leak
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice! Really like the improved testing. Thank you!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's add a changelog entry in changelog.next.asciidoc
Thanks for improving the code! 🤗
What does this PR do?
Populates input_type for the .fleet-actions-results. This allows to use kibana transformations on .fleet-actions-results for specific integration without a need to correlate them to the original .fleet-actions (via the action_id)
Why is it important?
Allows to use kibana transformations on .fleet-actions-results for specific integration without a need to correlate them to the original .fleet-actions (via the action_id)
Checklist
How to test this PR locally
One of the ways to test is with osquery integration, with corresponding change in fleet-server and elasticsearch fleet mapping. The .fleet-actions-results document should have the new field
input_type
.Screenshots