Update to ECS 1.12

elastic · Sep 13, 2021 · 3f254a4 · 3f254a4
1 parent 24c567a
commit 3f254a4
Show file tree

Hide file tree

Showing 17 changed files with 803 additions and 808 deletions.
diff --git a/packages/cisco_amp/_dev/build/build.yml b/packages/cisco_amp/_dev/build/build.yml
@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@1.11
+    reference: git@1.12
diff --git a/.../test/pipeline/test-cisco_amp1.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp1.log b/.../test/pipeline/test-cisco_amp1.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp1.log
diff --git a/.../test-cisco_amp1.ndjson.log-expected.json → ...ipeline/test-cisco-amp1.log-expected.json b/.../test-cisco_amp1.ndjson.log-expected.json → ...ipeline/test-cisco-amp1.log-expected.json
diff --git a/.../_dev/test/pipeline/cisco_amp2.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp2.log b/.../_dev/test/pipeline/cisco_amp2.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp2.log
diff --git a/...eline/cisco_amp2.ndjson.log-expected.json → ...ipeline/test-cisco-amp2.log-expected.json b/...eline/cisco_amp2.ndjson.log-expected.json → ...ipeline/test-cisco-amp2.log-expected.json
diff --git a/.../_dev/test/pipeline/cisco_amp3.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp3.log b/.../_dev/test/pipeline/cisco_amp3.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp3.log
diff --git a/...eline/cisco_amp3.ndjson.log-expected.json → ...ipeline/test-cisco-amp3.log-expected.json b/...eline/cisco_amp3.ndjson.log-expected.json → ...ipeline/test-cisco-amp3.log-expected.json
diff --git a/.../_dev/test/pipeline/cisco_amp4.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp4.log b/.../_dev/test/pipeline/cisco_amp4.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp4.log
diff --git a/...eline/cisco_amp4.ndjson.log-expected.json → ...ipeline/test-cisco-amp4.log-expected.json b/...eline/cisco_amp4.ndjson.log-expected.json → ...ipeline/test-cisco-amp4.log-expected.json
diff --git a/.../_dev/test/pipeline/cisco_amp5.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp5.log b/.../_dev/test/pipeline/cisco_amp5.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp5.log
diff --git a/...eline/cisco_amp5.ndjson.log-expected.json → ...ipeline/test-cisco-amp5.log-expected.json b/...eline/cisco_amp5.ndjson.log-expected.json → ...ipeline/test-cisco-amp5.log-expected.json
diff --git a/.../_dev/test/pipeline/cisco_amp6.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp6.log b/.../_dev/test/pipeline/cisco_amp6.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp6.log
diff --git a/...eline/cisco_amp6.ndjson.log-expected.json → ...ipeline/test-cisco-amp6.log-expected.json b/...eline/cisco_amp6.ndjson.log-expected.json → ...ipeline/test-cisco-amp6.log-expected.json
diff --git a/.../_dev/test/pipeline/cisco_amp7.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp7.log b/.../_dev/test/pipeline/cisco_amp7.ndjson.log → ...og/_dev/test/pipeline/test-cisco-amp7.log
diff --git a/...eline/cisco_amp7.ndjson.log-expected.json → ...ipeline/test-cisco-amp7.log-expected.json b/...eline/cisco_amp7.ndjson.log-expected.json → ...ipeline/test-cisco-amp7.log-expected.json
diff --git a/packages/cisco_amp/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/cisco_amp/data_stream/log/elasticsearch/ingest_pipeline/default.yml
@@ -16,11 +16,6 @@ processors:
     field: json.data
     target_field: cisco.amp
     ignore_missing: true
-- remove:
-    field:
-    - "@timestamp"
-    ignore_missing: true
-    if: ctx?.cisco?.amp?.timestamp != null
 - date:
     field: cisco.amp.timestamp
     formats:
@@ -35,7 +30,7 @@ processors:
     value: '{{_ingest.timestamp}}'
 - set:
     field: ecs.version
-    value: '1.11.0'
+    value: '1.12.0'
 - set:
     field: event.kind
     value: alert

diff --git a/packages/cisco_amp/docs/README.md b/packages/cisco_amp/docs/README.md
@@ -181,7 +181,7 @@ An example event for `log` looks as following:
 | destination.ip | IP address of the destination (IPv4 or IPv6). | ip |
 | destination.port | Port of the destination. | long |
 | ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword |
-| error.message | Error message. | text |
+| error.message | Error message. | match_only_text |
 | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword |
 | event.category | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy. `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory. This field is an array. This will allow proper categorization of some events that fall in multiple categories. | keyword |
 | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword |