Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[AWS] Add dimensions to firewall, transit gateway and vpn data streams #6339

Merged
merged 11 commits into from
Jun 5, 2023

Conversation

constanca-m
Copy link
Contributor

@constanca-m constanca-m commented May 26, 2023

What does this PR do?

Add dimensions to firewall, transit gateway and vpn data streams.

Transit gateway: A transit gateway can have more than one attachment, so it needs to be set as dimensions as well. A transit gateway is unique per AWS account.

VPN: Each tunnel belongs to a VPN. Combination tunnel id + vpn id is unique within the AWS scope account (account id + region).
Note: for each VPN site to site connection, there are four documents sent to ES. Is this expected?
image

Firewall: The firewall name is unique per region in an account. A firewall can have more than one engine and one Availability Zone, so both need to be set as dimension to avoid documents being overwritten. Since we can have more than one custom action in the same firewall, we also set that as dimension.
Question: CustomAction fields holds the name of the action. Since a firewall can have different groups (names are unique, but we don't have access to that field in this data stream), then we can also have different custom actions with the exact same name associated with one firewall. I tried to reproduce this, but even with multiple rules with the same name I kept receiving just one document for each rule. Without considering TSDB, can we receive two documents for the same action at the same time? If so, dimensions are not enough for this data stream.

Regarding ECS fields, more info can be found here #5193 (comment).

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • Verification of the count of documents (before & after TSDB enablement) in Discover Interface
  • Verify if field mapping is correct in the data stream template.

How to test this PR locally

Refer to #6293.

Related issues

Relates to #6293.

Signed-off-by: constanca-m <[email protected]>
Signed-off-by: constanca-m <[email protected]>
Signed-off-by: constanca-m <[email protected]>
@constanca-m constanca-m self-assigned this May 26, 2023
@constanca-m constanca-m requested a review from a team as a code owner May 26, 2023 10:51
Signed-off-by: constanca-m <[email protected]>
Copy link
Contributor

@agithomas agithomas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.36.9"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: in #6365 we bumped minor version, here only patch one
why the difference? :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1.37 changes were not related to TSDB, that is why I bumped to 1.38 in that PR. Unlike here, since 1.36.8 was a change to add dimensions.

@elasticmachine
Copy link

elasticmachine commented Jun 5, 2023

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-06-05T12:31:16.806+0000

  • Duration: 47 min 34 sec

Test stats 🧪

Test Results
Failed 0
Passed 188
Skipped 4
Total 192

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link

elasticmachine commented Jun 5, 2023

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (15/15) 💚
Files 93.75% (15/16) 👎 -6.25
Classes 93.75% (15/16) 👎 -6.25
Methods 86.131% (236/274) 👎 -10.095
Lines 85.925% (7387/8597) 👎 -3.963
Conditionals 100.0% (0/0) 💚

Signed-off-by: constanca-m <[email protected]>
@constanca-m constanca-m merged commit 67f52c8 into elastic:main Jun 5, 2023
@constanca-m constanca-m deleted the aws-add-dimensions-vpn branch June 5, 2023 13:22
@elasticmachine
Copy link

Package aws - 1.38.3 containing this change is available at https://epr.elastic.co/search?package=aws

sodhikirti07 pushed a commit that referenced this pull request Jun 15, 2023
#6339)

* Add dimensions VPN.

Signed-off-by: constanca-m <[email protected]>

* Add dimensions transit gateway.

Signed-off-by: constanca-m <[email protected]>

* Add dimensions firewall.

Signed-off-by: constanca-m <[email protected]>

* Update version.

Signed-off-by: constanca-m <[email protected]>

* Update changelog.

Signed-off-by: constanca-m <[email protected]>

* Add 2 ecs dimension fields.

Signed-off-by: constanca-m <[email protected]>

* Remove cloud.availability_zone as dimension (not present)

Signed-off-by: constanca-m <[email protected]>

* Update md.

Signed-off-by: constanca-m <[email protected]>

* Resolve conflict.

Signed-off-by: constanca-m <[email protected]>

---------

Signed-off-by: constanca-m <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants