Skip to content

Commit b50bfa1

Browse files
authored
Fix fileset field prefixing (#20170) (#20199)
When the fields.yml file is constructed it is done by appending files together and adding some indenting. In the case of Filebeat, a fileset's fields.yml is appended with an indent of 8 spaces to the module's fields.yml. This generally allows for all of the filesets fields to become children of the module. The problem we had was that the new filesets added in #19713 expected that their fields would be root fields (not children to the module namespace). In cases where the module already existed and had declared a module namespace field in its fields.yml this resulted in unexpectedly namespaced fieldset fields (e.g. microsoft.rsa.* instead of rsa.*). The size of the x-pack/filebeat index-pattern is still large (915885 bytes), but not so large that it goes beyond the Kibana request payload limit. Fixes #19965 (cherry picked from commit ea7c05f)
1 parent cc33060 commit b50bfa1

File tree

12 files changed

+4214
-4236
lines changed

12 files changed

+4214
-4236
lines changed

filebeat/docs/fields.asciidoc

+2,047-2,061
Large diffs are not rendered by default.

x-pack/filebeat/module/cisco/_meta/fields.yml

+1-5
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,4 @@
33
description: >
44
Module for handling Cisco network device logs.
55
fields:
6-
- name: cisco
7-
type: group
8-
description: >
9-
Fields from Cisco logs.
10-
fields:
6+

x-pack/filebeat/module/cisco/asa/_meta/fields.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
- name: asa
1+
- name: cisco.asa
22
type: group
33
description: >
44
Fields for Cisco ASA Firewall.

x-pack/filebeat/module/cisco/fields.go

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

x-pack/filebeat/module/cisco/ftd/_meta/fields.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
- name: ftd
1+
- name: cisco.ftd
22
type: group
33
description: >
44
Fields for Cisco Firepower Threat Defense Firewall.

x-pack/filebeat/module/cisco/ios/_meta/fields.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
- name: ios
1+
- name: cisco.ios
22
type: group
33
description: >
44
Fields for Cisco IOS logs.

x-pack/filebeat/module/fortinet/_meta/fields.yml

-9
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,3 @@
33
description: >
44
fortinet Module
55
fields:
6-
- name: fortinet
7-
type: group
8-
description: >
9-
Fields from fortinet FortiOS
10-
fields:
11-
- name: file.hash.crc32
12-
type: keyword
13-
description: >
14-
CRC32 Hash of file

x-pack/filebeat/module/fortinet/fields.go

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)