Azure Platform Logs: rename identity as identity_name when the value is a string

CHANGELOG.next.asciidoc

@@ -58,6 +58,7 @@ https://github.com/elastic/beats/compare/v8.2.0\...main[Check the HEAD diff]
 - Fix splitting array of strings/arrays in httpjson input {issue}30345[30345] {pull}33609[33609]
 - Fix Google workspace pagination and document ID generation. {pull}33666[33666]
 - Fix PANW handling of messages with event.original already set. {issue}33829[33829] {pull}33830[33830]
+- Rename identity as identity_name when the value is a string in Azure Platform Logs. {pull}33654[33654]
 
 *Heartbeat*
 - Fix broken zip URL monitors. NOTE: Zip URL Monitors will be removed in version 8.7 and replaced with project monitors. {pull}33723[33723]

filebeat/docs/fields.asciidoc

@@ -3001,6 +3001,16 @@ type: keyword
 ActivityId
 
 
+type: keyword
+
+--
+
+*`azure.platformlogs.identity_name`*::
++
+--
+Identity name
+
+
 type: keyword
 
 --

x-pack/filebeat/module/azure/platformlogs/_meta/fields.yml

@@ -56,6 +56,10 @@
       type: keyword
       description: >
         ActivityId
+    - name: identity_name
+      type: keyword
+      description: |
+        Identity name
     - name: properties
       type: flattened
       description: >

x-pack/filebeat/module/azure/platformlogs/ingest/pipeline.yml

@@ -15,6 +15,12 @@ processors:
 - json:
     field: message
     target_field: azure.platformlogs
+- rename:
+    field: azure.platformlogs.identity
+    target_field: azure.platformlogs.identity_name
+    ignore_missing: true
+    description: 'Rename the field to `identity_name` to avoid conflicts with the `identity` containing a JSON object.'
+    if: "ctx.azure?.platformlogs?.identity instanceof String"
 - date:
     field: azure.platformlogs.time
     target_field: '@timestamp'

x-pack/filebeat/module/azure/platformlogs/test/platformlogs-identity-raw.log

@@ -0,0 +1 @@
+{"Cloud":"AzureCloud","Environment":"prod","category":"kube-audit","ccpNamespace":"5e4bf4baee195b00017cdbfa","identity":"Michael Dell","operationName":"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read","properties":{"log":"{\"kind\":\"Event\"}","pod":"kube-apiserver-666bd4b459-hjgdc"},"resourceId":"/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE","time":"2020-11-09T10:57:31.0000000Z"}

x-pack/filebeat/module/azure/platformlogs/test/platformlogs-identity-raw.log-expected.json

@@ -0,0 +1,32 @@
+[
+    {
+        "@timestamp": "2020-11-09T10:57:31.000Z",
+        "azure.platformlogs.Cloud": "AzureCloud",
+        "azure.platformlogs.Environment": "prod",
+        "azure.platformlogs.category": "kube-audit",
+        "azure.platformlogs.ccpNamespace": "5e4bf4baee195b00017cdbfa",
+        "azure.platformlogs.event_category": "Administrative",
+        "azure.platformlogs.identity_name": "Michael Dell",
+        "azure.platformlogs.operation_name": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
+        "azure.platformlogs.properties.log.kind": "Event",
+        "azure.platformlogs.properties.pod": "kube-apiserver-666bd4b459-hjgdc",
+        "azure.resource.group": "OBS-INFRASTRUCTURE",
+        "azure.resource.id": "/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE",
+        "azure.resource.name": "OBSKUBE",
+        "azure.resource.provider": "MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS",
+        "azure.subscription_id": "70BD6E77-4B1E-4835-8896-DB77B8EEF364",
+        "cloud.provider": "azure",
+        "event.action": "Microsoft.ContainerService/managedClusters/diagnosticLogs/Read",
+        "event.dataset": "azure.platformlogs",
+        "event.kind": "event",
+        "event.module": "azure",
+        "event.original": "{\"Cloud\":\"AzureCloud\",\"Environment\":\"prod\",\"category\":\"kube-audit\",\"ccpNamespace\":\"5e4bf4baee195b00017cdbfa\",\"identity\":\"Michael Dell\",\"operationName\":\"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read\",\"properties\":{\"log\":\"{\\\"kind\\\":\\\"Event\\\"}\",\"pod\":\"kube-apiserver-666bd4b459-hjgdc\"},\"resourceId\":\"/SUBSCRIPTIONS/70BD6E77-4B1E-4835-8896-DB77B8EEF364/RESOURCEGROUPS/OBS-INFRASTRUCTURE/PROVIDERS/MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/OBSKUBE\",\"time\":\"2020-11-09T10:57:31.0000000Z\"}",
+        "fileset.name": "platformlogs",
+        "input.type": "log",
+        "log.offset": 0,
+        "service.type": "azure",
+        "tags": [
+            "forwarded"
+        ]
+    }
+]