[Arista NG Firewall] Bug fixes for initial release

[MakoWish]

Type of Change

• Bug

What does this PR do?

• Corrects variables in manifest
• Fixes duplicate assignment of _conf field

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• Correct variables in TCP input section of manifest
• Fix duplicate assignment of _conf field in both tcp.yml.hbs and udp.yml.hbs agent configurations.

Related issues

• Closes [Arista NG Firewall] Couple bugs found in initial release #6853

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-07-27T21:37:02.054+0000

• Duration: 17 min 53 sec

Test stats 🧪

Test	Results
Failed	0
Passed	16
Skipped	0
Total	16

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[efd6]

/test

[MakoWish]

Pinging @efd6 .

[efd6]

/test

[efd6]

diff --git a/packages/arista_ngfw/data_stream/log/fields/ecs.yml b/packages/arista_ngfw/data_stream/log/fields/ecs.yml index 63ac7c32b..26c4196ed 100755 --- a/packages/arista_ngfw/data_stream/log/fields/ecs.yml +++ b/packages/arista_ngfw/data_stream/log/fields/ecs.yml @@ -240,8 +240,6 @@ name: source.geo.country_iso_code - external: ecs name: source.geo.country_name -- external: ecs - name: source.geo.dma_code - external: ecs name: source.geo.location - external: ecs diff --git a/packages/arista_ngfw/docs/README.md b/packages/arista_ngfw/docs/README.md index 032d22507..595d31f35 100755 --- a/packages/arista_ngfw/docs/README.md +++ b/packages/arista_ngfw/docs/README.md @@ -15,6 +15,7 @@ Arista NG Firewall supports several syslog output rules that may be configured o * Interface Stat Event * Intrusion Prevention Log Event * Session Event +* Session Stats Event * System Stat Event * Web Filter Event @@ -210,6 +211,7 @@ An example event for `log` looks as following: | event.dataset | Event dataset | constant_keyword | | event.duration | Duration of the event in nanoseconds. If event.start and event.end are known this value should be the difference between the end and start time. | long | | event.end | event.end contains the date when the event ended or when the activity was last observed. | date | +| event.id | Unique ID to describe the event. | keyword | | event.ingested | Timestamp when an event arrived in the central data store. This is different from `@timestamp`, which is when the event originally occurred. It's also different from `event.created`, which is meant to capture the first time an agent saw the event. In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` \< `event.created` \< `event.ingested`. | date | | event.kind | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy. `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events. The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data coming in at a regular interval or not. | keyword | | event.module | Event module | constant_keyword | @@ -316,6 +318,7 @@ An example event for `log` looks as following: | source.geo.country_iso_code | Country ISO code. | keyword | | source.geo.country_name | Country name. | keyword | | source.geo.location | Longitude and latitude. | geo_point | +| source.geo.postal_code | Postal code associated with the location. Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | keyword | | source.geo.region_iso_code | Region ISO code. | keyword | | source.geo.region_name | Region name. | keyword | | source.ip | IP address of the source (IPv4 or IPv6). | ip |

[efd6]

/test

[efd6]

/test

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (1/1)	💚
Files	100.0% (8/8)	💚
Classes	100.0% (8/8)	💚
Methods	97.436% (38/39)	👎 -2.564
Lines	94.466% (956/1012)	👍 2.453
Conditionals	100.0% (0/0)	💚

[elasticmachine]

Package arista_ngfw - 0.1.2 containing this change is available at https://epr.elastic.co/search?package=arista_ngfw