Skip to content

Commit 06c3c88

Browse files
P1llusP1llus
authored
[Google Workspace] Adding additional date format to admin pipeline (#8912)
* adding date format to admin datastream * update changelog
1 parent 8592f94 commit 06c3c88

File tree

5 files changed

+101
-1
lines changed

5 files changed

+101
-1
lines changed

‎packages/google_workspace/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.19.1"
3+
changes:
4+
- description: Fixing timestamp format for Admin datastream
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/8912
27
- version: "2.19.0"
38
changes:
49
- description: Limit request tracer log count to five.

‎packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-docs.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"admin","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"DOCS_SETTINGS","name":"TRANSFER_DOCUMENT_OWNERSHIP","parameters":[{"name":"DOMAIN_NAME","value":"example.com"},{"name":"NEW_VALUE","value":"new"},{"name":"USER_EMAIL","value":"user@example.com"}]}}
22
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"admin","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"DOCS_SETTINGS","name":"DRIVE_DATA_RESTORE","parameters":[{"name":"BEGIN_DATE_TIME","value":"2002-10-02T12:00:00Z"},{"name":"END_DATE_TIME","value":"2002-10-02T15:00:00Z"},{"name":"USER_EMAIL","value":"user@example.com"}]}}
33
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"admin","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"DOCS_SETTINGS","name":"CHANGE_DOCS_SETTING","parameters":[{"name":"DOMAIN_NAME","value":"example.com"},{"name":"GROUP_EMAIL","value":"group@example.com"},{"name":"NEW_VALUE","value":"new"},{"name":"OLD_VALUE","value":"old"},{"name":"ORG_UNIT_NAME","value":"org"},{"name":"SETTING_NAME","value":"setting"}]}}
4+
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"admin","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"DOCS_SETTINGS","name":"DRIVE_DATA_RESTORE","parameters":[{"name":"BEGIN_DATE_TIME","value":"2023/12/08 18:30 UTC"},{"name":"END_DATE_TIME","value":"2024/01/02 11:33 UTC"},{"name":"USER_EMAIL","value":"user@example.com"}]}}

‎packages/google_workspace/data_stream/admin/_dev/test/pipeline/test-admin-docs.log-expected.json‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -271,6 +271,92 @@
271271
}
272272
}
273273
}
274+
},
275+
{
276+
"@timestamp": "2020-10-02T15:00:00.000Z",
277+
"ecs": {
278+
"version": "8.11.0"
279+
},
280+
"event": {
281+
"action": "DRIVE_DATA_RESTORE",
282+
"category": [
283+
"iam"
284+
],
285+
"duration": 2134980000000000,
286+
"end": "2024-01-02T11:33:00.000Z",
287+
"id": "1",
288+
"kind": "event",
289+
"original": "{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"admin\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"67.43.156.13\",\"events\":{\"type\":\"DOCS_SETTINGS\",\"name\":\"DRIVE_DATA_RESTORE\",\"parameters\":[{\"name\":\"BEGIN_DATE_TIME\",\"value\":\"2023/12/08 18:30 UTC\"},{\"name\":\"END_DATE_TIME\",\"value\":\"2024/01/02 11:33 UTC\"},{\"name\":\"USER_EMAIL\",\"value\":\"user@example.com\"}]}}",
290+
"provider": "admin",
291+
"start": "2023-12-08T18:30:00.000Z",
292+
"type": [
293+
"info"
294+
]
295+
},
296+
"google_workspace": {
297+
"actor": {
298+
"type": "USER"
299+
},
300+
"admin": {
301+
"user": {
302+
"email": "user@example.com"
303+
}
304+
},
305+
"event": {
306+
"type": "DOCS_SETTINGS"
307+
},
308+
"kind": "admin#reports#activity",
309+
"organization": {
310+
"domain": "elastic.com"
311+
}
312+
},
313+
"organization": {
314+
"id": "1"
315+
},
316+
"related": {
317+
"ip": [
318+
"67.43.156.13"
319+
],
320+
"user": [
321+
"foo",
322+
"user"
323+
]
324+
},
325+
"source": {
326+
"as": {
327+
"number": 35908
328+
},
329+
"geo": {
330+
"continent_name": "Asia",
331+
"country_iso_code": "BT",
332+
"country_name": "Bhutan",
333+
"location": {
334+
"lat": 27.5,
335+
"lon": 90.5
336+
}
337+
},
338+
"ip": "67.43.156.13",
339+
"user": {
340+
"domain": "bar.com",
341+
"email": "foo@bar.com",
342+
"id": "1",
343+
"name": "foo"
344+
}
345+
},
346+
"tags": [
347+
"preserve_original_event"
348+
],
349+
"user": {
350+
"domain": "bar.com",
351+
"email": "foo@bar.com",
352+
"id": "1",
353+
"name": "foo",
354+
"target": {
355+
"domain": "example.com",
356+
"email": "user@example.com",
357+
"name": "user"
358+
}
359+
}
274360
}
275361
]
276362
}

‎packages/google_workspace/data_stream/admin/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ processors:
2828
- yyyy-MM-dd'T'HH:mm:ssZ
2929
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
3030
- yyyy/MM/dd HH:mm:ss z
31+
- yyyy/MM/dd HH:mm z
3132
- fingerprint:
3233
description: Hashes the ID object and uses it as the document id to avoid duplicate events.
3334
fields:
@@ -578,6 +579,7 @@ processors:
578579
- yyyy-MM-dd'T'HH:mm:ssZ
579580
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
580581
- yyyy/MM/dd HH:mm:ss z
582+
- yyyy/MM/dd HH:mm z
581583
if: ctx?.google_workspace?.admin?.EMAIL_LOG_SEARCH_END_DATE != null
582584
- date:
583585
field: google_workspace.admin.EMAIL_LOG_SEARCH_START_DATE
@@ -589,6 +591,7 @@ processors:
589591
- yyyy-MM-dd'T'HH:mm:ssZ
590592
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
591593
- yyyy/MM/dd HH:mm:ss z
594+
- yyyy/MM/dd HH:mm z
592595
if: ctx?.google_workspace?.admin?.EMAIL_LOG_SEARCH_START_DATE != null
593596
- date:
594597
field: google_workspace.admin.BIRTHDATE
@@ -600,6 +603,7 @@ processors:
600603
- yyyy-MM-dd'T'HH:mm:ssZ
601604
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
602605
- yyyy/MM/dd HH:mm:ss z
606+
- yyyy/MM/dd HH:mm z
603607
if: ctx?.google_workspace?.admin?.BIRTHDATE != null
604608
- date:
605609
field: google_workspace.admin.BEGIN_DATE_TIME
@@ -611,6 +615,7 @@ processors:
611615
- yyyy-MM-dd'T'HH:mm:ssZ
612616
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
613617
- yyyy/MM/dd HH:mm:ss z
618+
- yyyy/MM/dd HH:mm z
614619
if: ctx?.google_workspace?.admin?.BEGIN_DATE_TIME != null
615620
- date:
616621
field: google_workspace.admin.START_DATE
@@ -622,6 +627,7 @@ processors:
622627
- yyyy-MM-dd'T'HH:mm:ssZ
623628
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
624629
- yyyy/MM/dd HH:mm:ss z
630+
- yyyy/MM/dd HH:mm z
625631
if: ctx?.google_workspace?.admin?.START_DATE != null
626632
- date:
627633
field: google_workspace.admin.END_DATE
@@ -633,6 +639,7 @@ processors:
633639
- yyyy-MM-dd'T'HH:mm:ssZ
634640
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
635641
- yyyy/MM/dd HH:mm:ss z
642+
- yyyy/MM/dd HH:mm z
636643
if: ctx?.google_workspace?.admin?.END_DATE != null
637644
- date:
638645
field: google_workspace.admin.END_DATE_TIME
@@ -644,6 +651,7 @@ processors:
644651
- yyyy-MM-dd'T'HH:mm:ssZ
645652
- yyyy-MM-dd'T'HH:mm:ss.SSSZ
646653
- yyyy/MM/dd HH:mm:ss z
654+
- yyyy/MM/dd HH:mm z
647655
if: ctx?.google_workspace?.admin?.END_DATE_TIME != null
648656
- script:
649657
lang: painless

‎packages/google_workspace/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: google_workspace
22
title: Google Workspace
3-
version: "2.19.0"
3+
version: "2.19.1"
44
source:
55
license: Elastic-2.0
66
description: Collect logs from Google Workspace with Elastic Agent.

0 commit comments

Comments
 (0)