Fix zeek connection pipeline (elastic#22151)

- connection state for rejected is 'REJ' Closes elastic#22149
v1v · Oct 26, 2020 · 5469c46 · 5469c46
1 parent 13a195a
commit 5469c46
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 1 deletion.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -287,6 +287,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix checkpoint module when logs contain time field. {pull}20567[20567]
 - Add field limit check for AWS Cloudtrail flattened fields. {pull}21388[21388] {issue}21382[21382]
 - Fix syslog RFC 5424 parsing in the CheckPoint module. {pull}21854[21854]
+- Fix incorrect connection state mapping in zeek connection pipeline. {pull}22151[22151] {issue}22149[22149]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/zeek/connection/ingest/pipeline.yml b/x-pack/filebeat/module/zeek/connection/ingest/pipeline.yml
@@ -115,7 +115,7 @@ processors:
           - connection
           - start
           - end
-      REG:
+      REJ:
         conn_str: "Connection attempt rejected."
         types:
           - connection
-Original file line number
+Diff line change
@@ Expand Up / @@ -115,7 +115,7 @@ processors: @@
               - connection
               - start
               - end
-          REG:
+          REJ:
             conn_str: "Connection attempt rejected."
             types:
               - connection
@@ Expand Down @@