Skip to content

Commit

Permalink
Add two migrated fields to ecs-migration from elastic#9645.
Browse files Browse the repository at this point in the history
Notes:

- Can't be aliased since `body` is moving to `body.content`.
- Currently only affects Packetbeat, so it's been listed only there,
even if these are ECS field defs.
- This will affect the ES Filebeat module logs as well. A note as been
added to elastic#9293, so it doesn't get forgotten.
  • Loading branch information
Mathieu Martin committed Jan 3, 2019
1 parent b1d96d3 commit 724f243
Showing 1 changed file with 15 additions and 0 deletions.
15 changes: 15 additions & 0 deletions dev-tools/ecs-migration.yml
Original file line number Diff line number Diff line change
Expand Up @@ -587,13 +587,28 @@
to: http.version
alias: true


# Auditbeat

## From Auditbeat's auditd module.
- from: source.hostname
to: source.domain
alias: true


# Packetbeat

- from: http.request.body
to: http.request.body.content
alias6: false
alias: false

- from: http.response.body
to: http.response.body.content
alias6: false
alias: false


# Metricbeat

## Metricbeat base fields
Expand Down

0 comments on commit 724f243

Please sign in to comment.