Skip to content

Commit 9c3504d

Browse files
efd6efd6
authored
aws: allow user specification of fields to retain in the cloudtrail data stream (#14236)
Storage of the response_elements, request_parameters and additional_eventdata is a potentially significant cost, but different users have different requirements for their present, so there is no ideal approach. Given that it is likely that this optimisation will be a common desire, provide a UI option to allow users to easily configure this behaviour without the requirement of adding processors to remove the fields in an @Custom pipeline. Note also that there is a TODO in the pipeline addition here to move from a remove after creation model, spending fruitless work, to a non-creation model, which would not be possible to implement in an @Custom pipeline.
1 parent afcda7a commit 9c3504d

16 files changed

+518
-2
lines changed

‎packages/aws/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "3.10.0"
3+
changes:
4+
- description: Allow user-specification of fields to retain in the cloudtrail data stream.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/14236
27
- version: "3.9.0"
38
changes:
49
- description: Ingest managed insights from Security Hub.

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-common-config.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,6 @@ fields:
99
tags:
1010
- preserve_original_event
1111
- actor_target_mapping
12+
# _conf.retain may be absent, null or '' with the same effect as 'all'.
13+
_conf:
14+
retain: all

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json-minimal.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
{"eventVersion":"1.09","userIdentity":{"type":"IAMUser","principalId":"ACCESSKEYID","arn":"arn:aws:iam::000000000:user/test@elastic.co","accountId":"000000000","accessKeyId":"ACCESSKEYID","userName":"test@elastic.co"},"eventTime":"2024-10-08T12:24:16Z","eventSource":"s3.amazonaws.com","eventName":"CopyObject","awsRegion":"us-east-1","sourceIPAddress":"216.160.83.56","userAgent":"[aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#s3api.copy-object]","requestParameters":{"bucketName":"elastic-cspm-cloudtrail-test-bucket","Host":"elastic-cspm-cloudtrail-test-bucket.s3.us-east-1.amazonaws.com","x-amz-copy-source":"elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md","key":"test-copy-object/README-copy.md"},"responseElements":{"x-amz-server-side-encryption":"AES256"},"additionalEventData":{"SignatureVersion":"SigV4","CipherSuite":"TLS_AES_128_GCM_SHA256","bytesTransferredIn":0,"SSEApplied":"Default_SSE_S3","AuthenticationMethod":"AuthHeader","x-amz-id-2":"hFhfe14yINVvz+alr1rC5zPFufFU087OGEbVwf5HpD1BYs5D2llscEUSD7DUGjlSYkOEoay+oVk=","bytesTransferredOut":224},"requestID":"62A9N2AH4P4YKG2B","eventID":"0c06e2ff-5e88-44e6-a081-57871bbe770b","readOnly":false,"resources":[{"type":"AWS::S3::Object","ARN":"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README-copy.md"},{"accountId":"000000000","type":"AWS::S3::Bucket","ARN":"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket"},{"type":"AWS::S3::Object","ARN":"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md"}],"eventType":"AwsApiCall","recipientAccountId":"000000000","eventCategory":"Data","tlsDetails":{"tlsVersion":"TLSv1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","clientProvidedHostHeader":"elastic-cspm-cloudtrail-test-bucket.s3.us-east-1.amazonaws.com"}}
2+

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json-minimal.log-config.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
dynamic_fields:
2+
# This can be removed after ES 8.16.2 is set as the minimum version supported in the manifest.
3+
# Once removed, it requires to update pipeline tests to remove the trailing dot where required.
4+
# Relates: https://github.com/elastic/elasticsearch/pull/117213
5+
"user_agent.version": '^\d+\.\d+(\.|\..*)?$'
6+
fields:
7+
# Simulate @timestamp value from Filebeat.
8+
'@timestamp': '2021-11-11T01:02:03.123456789Z'
9+
tags:
10+
- preserve_original_event
11+
- actor_target_mapping
12+
_conf:
13+
retain: minimal

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json-minimal.log-expected.json‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2024-10-08T12:24:16.000Z",
5+
"actor": {
6+
"entity": {
7+
"id": [
8+
"arn:aws:iam::000000000:user/test@elastic.co"
9+
]
10+
}
11+
},
12+
"aws": {
13+
"cloudtrail": {
14+
"additional_eventdata": "{SignatureVersion=SigV4, CipherSuite=TLS_AES_128_GCM_SHA256, bytesTransferredIn=0, SSEApplied=Default_SSE_S3, AuthenticationMethod=AuthHeader, x-amz-id-2=hFhfe14yINVvz+alr1rC5zPFufFU087OGEbVwf5HpD1BYs5D2llscEUSD7DUGjlSYkOEoay+oVk=, bytesTransferredOut=224}",
15+
"event_category": "Data",
16+
"event_type": "AwsApiCall",
17+
"event_version": "1.09",
18+
"flattened": {
19+
"additional_eventdata": {
20+
"SSEApplied": "Default_SSE_S3"
21+
}
22+
},
23+
"read_only": false,
24+
"recipient_account_id": "000000000",
25+
"request_id": "62A9N2AH4P4YKG2B",
26+
"request_parameters": "{bucketName=elastic-cspm-cloudtrail-test-bucket, Host=elastic-cspm-cloudtrail-test-bucket.s3.us-east-1.amazonaws.com, x-amz-copy-source=elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md, key=test-copy-object/README-copy.md}",
27+
"resources": [
28+
{
29+
"arn": "arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md",
30+
"type": "AWS::S3::Object"
31+
},
32+
{
33+
"arn": "arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README-copy.md",
34+
"type": "AWS::S3::Object"
35+
},
36+
{
37+
"account_id": "000000000",
38+
"arn": "arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket",
39+
"type": "AWS::S3::Bucket"
40+
}
41+
],
42+
"response_elements": "{x-amz-server-side-encryption=AES256}",
43+
"user_identity": {
44+
"access_key_id": "ACCESSKEYID",
45+
"arn": "arn:aws:iam::000000000:user/test@elastic.co",
46+
"type": "IAMUser"
47+
}
48+
}
49+
},
50+
"cloud": {
51+
"account": {
52+
"id": "000000000"
53+
},
54+
"region": "us-east-1"
55+
},
56+
"ecs": {
57+
"version": "8.11.0"
58+
},
59+
"event": {
60+
"action": "CopyObject",
61+
"created": "2021-11-11T01:02:03.123456789Z",
62+
"id": "0c06e2ff-5e88-44e6-a081-57871bbe770b",
63+
"kind": "event",
64+
"original": "{\"eventVersion\":\"1.09\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"ACCESSKEYID\",\"arn\":\"arn:aws:iam::000000000:user/test@elastic.co\",\"accountId\":\"000000000\",\"accessKeyId\":\"ACCESSKEYID\",\"userName\":\"test@elastic.co\"},\"eventTime\":\"2024-10-08T12:24:16Z\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"CopyObject\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"216.160.83.56\",\"userAgent\":\"[aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#s3api.copy-object]\",\"requestParameters\":{\"bucketName\":\"elastic-cspm-cloudtrail-test-bucket\",\"Host\":\"elastic-cspm-cloudtrail-test-bucket.s3.us-east-1.amazonaws.com\",\"x-amz-copy-source\":\"elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md\",\"key\":\"test-copy-object/README-copy.md\"},\"responseElements\":{\"x-amz-server-side-encryption\":\"AES256\"},\"additionalEventData\":{\"SignatureVersion\":\"SigV4\",\"CipherSuite\":\"TLS_AES_128_GCM_SHA256\",\"bytesTransferredIn\":0,\"SSEApplied\":\"Default_SSE_S3\",\"AuthenticationMethod\":\"AuthHeader\",\"x-amz-id-2\":\"hFhfe14yINVvz+alr1rC5zPFufFU087OGEbVwf5HpD1BYs5D2llscEUSD7DUGjlSYkOEoay+oVk=\",\"bytesTransferredOut\":224},\"requestID\":\"62A9N2AH4P4YKG2B\",\"eventID\":\"0c06e2ff-5e88-44e6-a081-57871bbe770b\",\"readOnly\":false,\"resources\":[{\"type\":\"AWS::S3::Object\",\"ARN\":\"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README-copy.md\"},{\"accountId\":\"000000000\",\"type\":\"AWS::S3::Bucket\",\"ARN\":\"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket\"},{\"type\":\"AWS::S3::Object\",\"ARN\":\"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md\"}],\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"000000000\",\"eventCategory\":\"Data\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.3\",\"cipherSuite\":\"TLS_AES_128_GCM_SHA256\",\"clientProvidedHostHeader\":\"elastic-cspm-cloudtrail-test-bucket.s3.us-east-1.amazonaws.com\"}}",
65+
"outcome": "success",
66+
"provider": "s3.amazonaws.com",
67+
"type": [
68+
"info"
69+
]
70+
},
71+
"related": {
72+
"entity": [
73+
"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket",
74+
"test@elastic.co",
75+
"elastic-cspm-cloudtrail-test-bucket",
76+
"ACCESSKEYID",
77+
"arn:aws:iam::000000000:user/test@elastic.co",
78+
"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README-copy.md",
79+
"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md"
80+
],
81+
"user": [
82+
"ACCESSKEYID",
83+
"test@elastic.co"
84+
]
85+
},
86+
"source": {
87+
"address": "216.160.83.56",
88+
"as": {
89+
"number": 209
90+
},
91+
"geo": {
92+
"city_name": "Milton",
93+
"continent_name": "North America",
94+
"country_iso_code": "US",
95+
"country_name": "United States",
96+
"location": {
97+
"lat": 47.2513,
98+
"lon": -122.3149
99+
},
100+
"region_iso_code": "US-WA",
101+
"region_name": "Washington"
102+
},
103+
"ip": "216.160.83.56"
104+
},
105+
"tags": [
106+
"preserve_original_event",
107+
"actor_target_mapping"
108+
],
109+
"target": {
110+
"entity": {
111+
"id": [
112+
"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket",
113+
"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README-copy.md",
114+
"arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md"
115+
]
116+
}
117+
},
118+
"tls": {
119+
"cipher": "TLS_AES_128_GCM_SHA256",
120+
"client": {
121+
"server_name": "elastic-cspm-cloudtrail-test-bucket.s3.us-east-1.amazonaws.com"
122+
},
123+
"version": "1.3",
124+
"version_protocol": "tls"
125+
},
126+
"user": {
127+
"email": "test@elastic.co",
128+
"id": "ACCESSKEYID",
129+
"name": "test@elastic.co"
130+
},
131+
"user_agent": {
132+
"device": {
133+
"name": "Other"
134+
},
135+
"name": "aws-cli",
136+
"original": "[aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#s3api.copy-object]",
137+
"version": "2.17.60"
138+
}
139+
},
140+
{
141+
"@timestamp": "2021-11-11T01:02:03.123456789Z",
142+
"ecs": {
143+
"version": "8.11.0"
144+
},
145+
"event": {
146+
"created": "2021-11-11T01:02:03.123456789Z",
147+
"kind": "event",
148+
"outcome": "success",
149+
"type": [
150+
"info"
151+
]
152+
},
153+
"tags": [
154+
"preserve_original_event",
155+
"actor_target_mapping"
156+
]
157+
}
158+
]
159+
}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-flattened.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"EXAMPLE_ID","arn":"arn:aws:iam::0123456789012:user/Alice","accountId":"0123456789012","accessKeyId":"EXAMPLE_KEY","userName":"Alice","sessionContext":{"attributes":{"mfaAuthenticated":"true","creationDate":"2020-01-10T14:38:30Z"}},"invokedBy":"signin.amazonaws.com"},"eventTime":"2020-01-10T16:06:40Z","eventSource":"iam.amazonaws.com","eventName":"UploadSSHPublicKey","awsRegion":"us-east-1","sourceIPAddress":"127.0.0.1","userAgent":"signin.amazonaws.com","requestParameters":{"sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain","userName":"Alice"},"responseElements":{"sSHPublicKey":{"fingerprint":"de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de","status":"Active","uploadDate":"Jan 10, 2020 4:06:40 PM","userName":"Alice","sSHPublicKeyId":"EXAMPLE_KEY_ID","sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain"}},"requestID":"EXAMPLE-44b9-41cd-90f2-EXAMPLE","eventID":"EXAMPLE-9a9d-4da4-9998-EXAMPLE","eventType":"AwsApiCall","recipientAccountId":"0123456789012"}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-flattened.log-config.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
dynamic_fields:
2+
# This can be removed after ES 8.16.2 is set as the minimum version supported in the manifest.
3+
# Once removed, it requires to update pipeline tests to remove the trailing dot where required.
4+
# Relates: https://github.com/elastic/elasticsearch/pull/117213
5+
"user_agent.version": '^\d+\.\d+(\.|\..*)?$'
6+
fields:
7+
# Simulate @timestamp value from Filebeat.
8+
'@timestamp': '2021-11-11T01:02:03.123456789Z'
9+
tags:
10+
- preserve_original_event
11+
- actor_target_mapping
12+
_conf:
13+
retain: flattened

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-flattened.log-expected.json‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2020-01-10T16:06:40.000Z",
5+
"actor": {
6+
"entity": {
7+
"id": [
8+
"arn:aws:iam::0123456789012:user/Alice"
9+
]
10+
}
11+
},
12+
"aws": {
13+
"cloudtrail": {
14+
"event_type": "AwsApiCall",
15+
"event_version": "1.05",
16+
"flattened": {
17+
"request_parameters": {
18+
"sSHPublicKeyBody": "ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain",
19+
"userName": "Alice"
20+
},
21+
"response_elements": {
22+
"sSHPublicKey": {
23+
"fingerprint": "de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de",
24+
"sSHPublicKeyBody": "ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain",
25+
"sSHPublicKeyId": "EXAMPLE_KEY_ID",
26+
"status": "Active",
27+
"uploadDate": "Jan 10, 2020 4:06:40 PM",
28+
"userName": "Alice"
29+
}
30+
}
31+
},
32+
"recipient_account_id": "0123456789012",
33+
"request_id": "EXAMPLE-44b9-41cd-90f2-EXAMPLE",
34+
"user_identity": {
35+
"access_key_id": "EXAMPLE_KEY",
36+
"arn": "arn:aws:iam::0123456789012:user/Alice",
37+
"invoked_by": "signin.amazonaws.com",
38+
"session_context": {
39+
"creation_date": "2020-01-10T14:38:30.000Z",
40+
"mfa_authenticated": "true"
41+
},
42+
"type": "IAMUser"
43+
}
44+
}
45+
},
46+
"cloud": {
47+
"account": {
48+
"id": "0123456789012"
49+
},
50+
"region": "us-east-1"
51+
},
52+
"ecs": {
53+
"version": "8.11.0"
54+
},
55+
"event": {
56+
"action": "UploadSSHPublicKey",
57+
"created": "2021-11-11T01:02:03.123456789Z",
58+
"id": "EXAMPLE-9a9d-4da4-9998-EXAMPLE",
59+
"kind": "event",
60+
"original": "{\"eventVersion\":\"1.05\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"EXAMPLE_ID\",\"arn\":\"arn:aws:iam::0123456789012:user/Alice\",\"accountId\":\"0123456789012\",\"accessKeyId\":\"EXAMPLE_KEY\",\"userName\":\"Alice\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"true\",\"creationDate\":\"2020-01-10T14:38:30Z\"}},\"invokedBy\":\"signin.amazonaws.com\"},\"eventTime\":\"2020-01-10T16:06:40Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"UploadSSHPublicKey\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"signin.amazonaws.com\",\"requestParameters\":{\"sSHPublicKeyBody\":\"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain\",\"userName\":\"Alice\"},\"responseElements\":{\"sSHPublicKey\":{\"fingerprint\":\"de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de\",\"status\":\"Active\",\"uploadDate\":\"Jan 10, 2020 4:06:40 PM\",\"userName\":\"Alice\",\"sSHPublicKeyId\":\"EXAMPLE_KEY_ID\",\"sSHPublicKeyBody\":\"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain\"}},\"requestID\":\"EXAMPLE-44b9-41cd-90f2-EXAMPLE\",\"eventID\":\"EXAMPLE-9a9d-4da4-9998-EXAMPLE\",\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"0123456789012\"}",
61+
"outcome": "success",
62+
"provider": "iam.amazonaws.com",
63+
"type": [
64+
"info"
65+
]
66+
},
67+
"related": {
68+
"entity": [
69+
"EXAMPLE_KEY",
70+
"Alice",
71+
"arn:aws:iam::0123456789012:user/Alice"
72+
],
73+
"user": [
74+
"Alice",
75+
"EXAMPLE_ID"
76+
]
77+
},
78+
"source": {
79+
"address": "127.0.0.1",
80+
"ip": "127.0.0.1"
81+
},
82+
"tags": [
83+
"preserve_original_event",
84+
"actor_target_mapping"
85+
],
86+
"user": {
87+
"id": "EXAMPLE_ID",
88+
"name": "Alice",
89+
"target": {
90+
"name": "Alice"
91+
}
92+
},
93+
"user_agent": {
94+
"device": {
95+
"name": "Other"
96+
},
97+
"name": "Other",
98+
"original": "signin.amazonaws.com"
99+
}
100+
}
101+
]
102+
}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-keyword.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"EXAMPLE_ID","arn":"arn:aws:iam::0123456789012:user/Alice","accountId":"0123456789012","accessKeyId":"EXAMPLE_KEY","userName":"Alice","sessionContext":{"attributes":{"mfaAuthenticated":"true","creationDate":"2020-01-10T14:38:30Z"}},"invokedBy":"signin.amazonaws.com"},"eventTime":"2020-01-10T16:06:40Z","eventSource":"iam.amazonaws.com","eventName":"UploadSSHPublicKey","awsRegion":"us-east-1","sourceIPAddress":"127.0.0.1","userAgent":"signin.amazonaws.com","requestParameters":{"sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain","userName":"Alice"},"responseElements":{"sSHPublicKey":{"fingerprint":"de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de","status":"Active","uploadDate":"Jan 10, 2020 4:06:40 PM","userName":"Alice","sSHPublicKeyId":"EXAMPLE_KEY_ID","sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain"}},"requestID":"EXAMPLE-44b9-41cd-90f2-EXAMPLE","eventID":"EXAMPLE-9a9d-4da4-9998-EXAMPLE","eventType":"AwsApiCall","recipientAccountId":"0123456789012"}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-keyword.log-config.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
dynamic_fields:
2+
# This can be removed after ES 8.16.2 is set as the minimum version supported in the manifest.
3+
# Once removed, it requires to update pipeline tests to remove the trailing dot where required.
4+
# Relates: https://github.com/elastic/elasticsearch/pull/117213
5+
"user_agent.version": '^\d+\.\d+(\.|\..*)?$'
6+
fields:
7+
# Simulate @timestamp value from Filebeat.
8+
'@timestamp': '2021-11-11T01:02:03.123456789Z'
9+
tags:
10+
- preserve_original_event
11+
- actor_target_mapping
12+
_conf:
13+
retain: keyword

0 commit comments

Comments
 (0)