From b18b333022052d22bb515af99b926c6f58d145d4 Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Fri, 30 Oct 2020 11:53:29 +0100 Subject: [PATCH] adding timeout options to cisco umbrella and fixing the missing config options in module config.yml (#22295) --- filebeat/docs/modules/cisco.asciidoc | 9 +++++++++ x-pack/filebeat/filebeat.reference.yml | 15 +++++++++++++++ x-pack/filebeat/module/cisco/_meta/config.yml | 15 +++++++++++++++ x-pack/filebeat/module/cisco/_meta/docs.asciidoc | 9 +++++++++ .../module/cisco/umbrella/config/input.yml | 2 ++ .../filebeat/module/cisco/umbrella/manifest.yml | 4 ++++ x-pack/filebeat/modules.d/cisco.yml.disabled | 15 +++++++++++++++ 7 files changed, 69 insertions(+) diff --git a/filebeat/docs/modules/cisco.asciidoc b/filebeat/docs/modules/cisco.asciidoc index d087826245e4..742fe8020bcd 100644 --- a/filebeat/docs/modules/cisco.asciidoc +++ b/filebeat/docs/modules/cisco.asciidoc @@ -432,6 +432,15 @@ The ID for the access key used to read from the SQS queue. The secret token used for authenticating to the SQS queue. +*`var.visibility_timeout`*:: + +The duration that the received messages are hidden from ReceiveMessage request. +Default to be 300 seconds. + +*`var.api_timeout`*:: + +Maximum duration before AWS API request will be interrupted. Default to be 120 seconds. + :has-dashboards!: :fileset_ex!: diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml index 80bfacbf2c33..c36845ab0344 100644 --- a/x-pack/filebeat/filebeat.reference.yml +++ b/x-pack/filebeat/filebeat.reference.yml @@ -559,6 +559,21 @@ filebeat.modules: # "+02:00" for GMT+02:00 # var.tz_offset: local + umbrella: + enabled: true + + #var.input: s3 + # AWS SQS queue url + #var.queue_url: https://sqs.us-east-1.amazonaws.com/ID/CiscoQueue + # Access ID to authenticate with the S3 input + #var.access_key_id: 123456 + # Access key to authenticate with the S3 input + #var.secret_access_key: PASSWORD + # The duration that the received messages are hidden from ReceiveMessage request + #var.visibility_timeout: 300s + # Maximum duration before AWS API request will be interrupted + #var.api_timeout: 120s + #--------------------------- Citrix NetScaler Module --------------------------- - module: citrix netscaler: diff --git a/x-pack/filebeat/module/cisco/_meta/config.yml b/x-pack/filebeat/module/cisco/_meta/config.yml index 79f755c2c1f2..c9c670fc095a 100644 --- a/x-pack/filebeat/module/cisco/_meta/config.yml +++ b/x-pack/filebeat/module/cisco/_meta/config.yml @@ -89,3 +89,18 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + umbrella: + enabled: true + + #var.input: s3 + # AWS SQS queue url + #var.queue_url: https://sqs.us-east-1.amazonaws.com/ID/CiscoQueue + # Access ID to authenticate with the S3 input + #var.access_key_id: 123456 + # Access key to authenticate with the S3 input + #var.secret_access_key: PASSWORD + # The duration that the received messages are hidden from ReceiveMessage request + #var.visibility_timeout: 300s + # Maximum duration before AWS API request will be interrupted + #var.api_timeout: 120s diff --git a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc index aaf285680e07..268d2eeea768 100644 --- a/x-pack/filebeat/module/cisco/_meta/docs.asciidoc +++ b/x-pack/filebeat/module/cisco/_meta/docs.asciidoc @@ -427,6 +427,15 @@ The ID for the access key used to read from the SQS queue. The secret token used for authenticating to the SQS queue. +*`var.visibility_timeout`*:: + +The duration that the received messages are hidden from ReceiveMessage request. +Default to be 300 seconds. + +*`var.api_timeout`*:: + +Maximum duration before AWS API request will be interrupted. Default to be 120 seconds. + :has-dashboards!: :fileset_ex!: diff --git a/x-pack/filebeat/module/cisco/umbrella/config/input.yml b/x-pack/filebeat/module/cisco/umbrella/config/input.yml index 8b0ccde6e2eb..569392a26a96 100644 --- a/x-pack/filebeat/module/cisco/umbrella/config/input.yml +++ b/x-pack/filebeat/module/cisco/umbrella/config/input.yml @@ -4,6 +4,8 @@ type: s3 queue_url: {{ .queue_url }} access_key_id: {{ .access_key_id }} secret_access_key: {{ .secret_access_key }} +visibility_timeout: {{ .visibility_timeout }} +api_timeout: {{ .api_timeout }} {{ else if eq .input "file" }} diff --git a/x-pack/filebeat/module/cisco/umbrella/manifest.yml b/x-pack/filebeat/module/cisco/umbrella/manifest.yml index 3a7150e714dd..f85553d29eb4 100644 --- a/x-pack/filebeat/module/cisco/umbrella/manifest.yml +++ b/x-pack/filebeat/module/cisco/umbrella/manifest.yml @@ -3,6 +3,10 @@ module_version: "1.0" var: - name: tags default: [cisco-umbrella, forwarded] + - name: visibility_timeout + default: 300 + - name: api_timeout + default: 120 ingest_pipeline: ingest/pipeline.yml input: config/input.yml diff --git a/x-pack/filebeat/modules.d/cisco.yml.disabled b/x-pack/filebeat/modules.d/cisco.yml.disabled index a2795fac8fca..2dc8389a8d26 100644 --- a/x-pack/filebeat/modules.d/cisco.yml.disabled +++ b/x-pack/filebeat/modules.d/cisco.yml.disabled @@ -92,3 +92,18 @@ # "local" (default) for system timezone. # "+02:00" for GMT+02:00 # var.tz_offset: local + + umbrella: + enabled: true + + #var.input: s3 + # AWS SQS queue url + #var.queue_url: https://sqs.us-east-1.amazonaws.com/ID/CiscoQueue + # Access ID to authenticate with the S3 input + #var.access_key_id: 123456 + # Access key to authenticate with the S3 input + #var.secret_access_key: PASSWORD + # The duration that the received messages are hidden from ReceiveMessage request + #var.visibility_timeout: 300s + # Maximum duration before AWS API request will be interrupted + #var.api_timeout: 120s