Populate action_input_type for the .fleet-actions-results (#1164)

* Populate input_type for the .fleet-actions-results * Change input_type to action_input_type. Ensure unit test coverage
elastic · Feb 28, 2022 · a505ff4 · a505ff4
1 parent 852e173
commit a505ff4
Show file tree

Hide file tree

Showing 5 changed files with 87 additions and 25 deletions.
diff --git a/cmd/fleet/handleAck.go b/cmd/fleet/handleAck.go
@@ -151,6 +151,20 @@ func (ack *AckT) processRequest(zlog zerolog.Logger, w http.ResponseWriter, r *h
 	return nil
 }
 
+func eventToActionResult(agentId string, ev Event) (acr model.ActionResult) {
+	return model.ActionResult{
+		ActionId:        ev.ActionId,
+		AgentId:         agentId,
+		ActionInputType: ev.ActionInputType,
+		StartedAt:       ev.StartedAt,
+		CompletedAt:     ev.CompletedAt,
+		ActionData:      ev.ActionData,
+		ActionResponse:  ev.ActionResponse,
+		Data:            ev.Data,
+		Error:           ev.Error,
+	}
+}
+
 func (ack *AckT) handleAckEvents(ctx context.Context, zlog zerolog.Logger, agent *model.Agent, events []Event) error {
 	var policyAcks []string
 	var unenroll bool
@@ -187,16 +201,8 @@ func (ack *AckT) handleAckEvents(ctx context.Context, zlog zerolog.Logger, agent
 			ack.cache.SetAction(action)
 		}
 
-		acr := model.ActionResult{
-			ActionId:       ev.ActionId,
-			AgentId:        agent.Id,
-			StartedAt:      ev.StartedAt,
-			CompletedAt:    ev.CompletedAt,
-			ActionData:     ev.ActionData,
-			ActionResponse: ev.ActionResponse,
-			Data:           ev.Data,
-			Error:          ev.Error,
-		}
+		acr := eventToActionResult(agent.Id, ev)
+
 		if _, err := dl.CreateActionResult(ctx, ack.bulk, acr); err != nil {
 			return errors.Wrap(err, "create action result")
 		}

diff --git a/cmd/fleet/handleAck_test.go b/cmd/fleet/handleAck_test.go
@@ -8,6 +8,8 @@ import (
 	"testing"
 
 	"encoding/json"
+
+	"github.com/stretchr/testify/assert"
 )
 
 func BenchmarkMakeUpdatePolicyBody(b *testing.B) {
@@ -37,3 +39,49 @@ func TestMakeUpdatePolicyBody(t *testing.T) {
 		t.Fatal(err)
 	}
 }
+
+func TestEventToActionResult(t *testing.T) {
+	agentId := "6e9b6655-8cfe-4eb6-9b2f-c10aefae7517"
+
+	tests := []struct {
+		name string
+		ev   Event
+	}{
+		{
+			name: "success",
+			ev: Event{
+				ActionId:        "1b12dcd8-bde0-4045-92dc-c4b27668d733",
+				ActionInputType: "osquery",
+				StartedAt:       "2022-02-23T18:26:08.506128Z",
+				CompletedAt:     "2022-02-23T18:26:08.507593Z",
+				ActionData:      []byte(`{"query": "select * from osquery_info"}`),
+				ActionResponse:  []byte(`{"osquery": {"count": 1}}`),
+			},
+		},
+		{
+			name: "error",
+			ev: Event{
+				ActionId:        "2b12dcd8-bde0-4045-92dc-c4b27668d733",
+				ActionInputType: "osquery",
+				StartedAt:       "2022-02-24T18:26:08.506128Z",
+				CompletedAt:     "2022-02-24T18:26:08.507593Z",
+				ActionData:      []byte(`{"query": "select * from osquery_info"}`),
+				Error:           "action undefined",
+			},
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			acr := eventToActionResult(agentId, tc.ev)
+			assert.Equal(t, agentId, acr.AgentId)
+			assert.Equal(t, tc.ev.ActionId, acr.ActionId)
+			assert.Equal(t, tc.ev.ActionInputType, acr.ActionInputType)
+			assert.Equal(t, tc.ev.StartedAt, acr.StartedAt)
+			assert.Equal(t, tc.ev.CompletedAt, acr.CompletedAt)
+			assert.Equal(t, tc.ev.ActionData, acr.ActionData)
+			assert.Equal(t, tc.ev.ActionResponse, acr.ActionResponse)
+			assert.Equal(t, tc.ev.Error, acr.Error)
+		})
+	}
+}
diff --git a/cmd/fleet/schema.go b/cmd/fleet/schema.go
@@ -102,21 +102,22 @@ type ActionResp struct {
 }
 
 type Event struct {
-	Type           string          `json:"type"`
-	SubType        string          `json:"subtype"`
-	AgentId        string          `json:"agent_id"`
-	ActionId       string          `json:"action_id"`
-	PolicyId       string          `json:"policy_id"`
-	StreamId       string          `json:"stream_id"`
-	Timestamp      string          `json:"timestamp"`
-	Message        string          `json:"message"`
-	Payload        json.RawMessage `json:"payload,omitempty"`
-	StartedAt      string          `json:"started_at"`
-	CompletedAt    string          `json:"completed_at"`
-	ActionData     json.RawMessage `json:"action_data,omitempty"`
-	ActionResponse json.RawMessage `json:"action_response,omitempty"`
-	Data           json.RawMessage `json:"data,omitempty"`
-	Error          string          `json:"error,omitempty"`
+	Type            string          `json:"type"`
+	SubType         string          `json:"subtype"`
+	AgentId         string          `json:"agent_id"`
+	ActionId        string          `json:"action_id"`
+	ActionInputType string          `json:"action_input_type"`
+	PolicyId        string          `json:"policy_id"`
+	StreamId        string          `json:"stream_id"`
+	Timestamp       string          `json:"timestamp"`
+	Message         string          `json:"message"`
+	Payload         json.RawMessage `json:"payload,omitempty"`
+	StartedAt       string          `json:"started_at"`
+	CompletedAt     string          `json:"completed_at"`
+	ActionData      json.RawMessage `json:"action_data,omitempty"`
+	ActionResponse  json.RawMessage `json:"action_response,omitempty"`
+	Data            json.RawMessage `json:"data,omitempty"`
+	Error           string          `json:"error,omitempty"`
 }
 
 type StatusResponseVersion struct {

diff --git a/internal/pkg/model/schema.go b/internal/pkg/model/schema.go
diff --git a/model/schema.json b/model/schema.json
@@ -82,6 +82,10 @@
           "description": "The action id.",
           "type": "string"
         },
+        "action_input_type": {
+          "description": "The input type of the original action.",
+          "type": "string"
+        },
         "started_at": {
           "description": "Date/time the action was started",
           "type": "string",