Move ecs.version labeling and JSON decoding to Ingest Node #670
Assignees
Labels
Comments
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
|
It looks like Zoom and System/auth are the two remaining packages that need to have their processors moved over to Ingest Node. |
leehinman
added a commit
to leehinman/integrations
that referenced
this issue
Aug 4, 2021
- remove extraneous filebeat json processor - update tests - change ecs field definitions to use external definitions Relates elastic#670
leehinman
added a commit
that referenced
this issue
Aug 5, 2021
* Set ecs.version to 1.11.0 - change setting ecs.version to pipeline - remove extraneous filebeat json processor - update tests - change ecs field definitions to use external definitions - add preserve original event option and set tag Relates #670
eyalkraft
pushed a commit
to build-security/integrations
that referenced
this issue
Mar 30, 2022
* Set ecs.version to 1.11.0 - change setting ecs.version to pipeline - remove extraneous filebeat json processor - update tests - change ecs field definitions to use external definitions - add preserve original event option and set tag Relates elastic#670
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Convert edge processing to Ingest Node pipeline
These packages may use a Beat processor or two to add the ecs.version field or
decode JSON. We want to migrate that into the Ingest Node pipeline that is part
of the package to make reuse easier (e.g. data from Kafka could be routed
through the pipeline).
Data Streams
auditd log (inputs: log) [auditd] Move edge to ingest pipeline and make event.original optional #989
AWS cloudtrail (inputs: s3) [AWS] Update ECS version, add event.original options and preparing for package GA #1070
CheckPoint firewall (inputs: log, tcp, udp) [Checkpoint] updating checkpoint package to ECS 1.10.0 #1033
Cisco asa (inputs: log, udp) [Cisco] Removing edge processing and updating field definitions #775
Cisco ftd (inputs: log, udp)
Fortinet firewall (inputs: log, tcp, udp) [fortinet] Make event.original optional in fortinet #1075
Juniper srx (inputs: log, tcp, udp) [Juniper] update juniper ECS version and add event.original options #1058
Netflow log (inputs: netflow) [netflow] Add pipeline tests and move ecs.version to ingest pipeline #1006
osquery result (inputs: log) [osquery] Make event.original optional, bump ECS version and add custom processors #1139
Santa log (inputs: log) [Santa] update santa ECS version and adding event.original options #1100
System auth (inputs: log) system update to ECS 1.11.0 #1429
Zeek capture_loss (inputs: log) [Zeek] update zeek ECS version and adding processor fields #1109
Zoom webhook (inputs: http_endpoint) zoom update to ECS 1.11.0 #1430
The text was updated successfully, but these errors were encountered: