[Filebeat] [tests] Keep host.name in forwarded events

Update Filebeat's test_modules.py integration test to not strip the `host.name` field in events marked as forwarded. Relates elastic#13920
adriansr · Jul 2, 2020 · ca1da94 · ca1da94
1 parent 794ed81
commit ca1da94
Show file tree

Hide file tree

Showing 16 changed files with 353 additions and 2 deletions.
diff --git a/filebeat/tests/system/test_modules.py b/filebeat/tests/system/test_modules.py
@@ -216,7 +216,11 @@ def _test_expected_events(self, test_file, objects):
 
 def clean_keys(obj):
     # These keys are host dependent
-    host_keys = ["host.name", "agent.name", "agent.type", "agent.ephemeral_id", "agent.id"]
+    host_keys = ["agent.name", "agent.type", "agent.ephemeral_id", "agent.id"]
+    # Strip host.name if event is not tagged as `forwarded`.
+    if "tags" not in obj or "forwarded" not in obj["tags"]:
+        host_keys.append("host.name")
+
     # The create timestamps area always new
     time_keys = ["event.created"]
     # source path and agent.version can be different for each run

diff --git a/x-pack/filebeat/module/cisco/ftd/test/firepower-management.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/firepower-management.log-expected.json
@@ -7,6 +7,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 0,
@@ -26,6 +27,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 194,
@@ -45,6 +47,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 386,
@@ -64,6 +67,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 568,
@@ -83,6 +87,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 774,
@@ -102,6 +107,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 943,
@@ -121,6 +127,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1072,
@@ -140,6 +147,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1191,
@@ -159,6 +167,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1316,
@@ -178,6 +187,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1440,
@@ -197,6 +207,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1575,
@@ -216,6 +227,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1721,
@@ -235,6 +247,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1867,
@@ -254,6 +267,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 1984,
@@ -273,6 +287,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 2128,
@@ -292,6 +307,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 2285,
@@ -311,6 +327,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 2436,
@@ -330,6 +347,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 2580,
@@ -349,6 +367,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 2737,
@@ -368,6 +387,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 2888,
@@ -387,6 +407,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 3032,
@@ -406,6 +427,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 3143,
@@ -425,6 +447,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 3267,
@@ -444,6 +467,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 3440,
@@ -463,6 +487,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 3564,
@@ -482,6 +507,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 3739,
@@ -501,6 +527,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 3874,
@@ -520,6 +547,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 4002,
@@ -539,6 +567,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 4113,
@@ -558,6 +587,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 4238,
@@ -577,6 +607,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 4357,
@@ -596,6 +627,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 4492,
@@ -615,6 +647,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 4686,
@@ -634,6 +667,7 @@
         "event.severity": 7,
         "event.timezone": "-02:00",
         "fileset.name": "ftd",
+        "host.name": "siem-management",
         "input.type": "log",
         "log.level": "debug",
         "log.offset": 4870,

diff --git a/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json b/x-pack/filebeat/module/cisco/ftd/test/security-connection.log-expected.json
@@ -904,4 +904,4 @@
         "user.name": "No Authentication Required",
         "user_agent.original": "curl/7.58.0"
     }
-]
+]
diff --git a/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-audit-events.log-expected.json b/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-audit-events.log-expected.json
@@ -19,6 +19,7 @@
             "start"
         ],
         "fileset.name": "falcon",
+        "host.name": "hostnameofmachine",
         "input.type": "log",
         "log.flags": [
             "multiline"
@@ -52,6 +53,7 @@
             "end"
         ],
         "fileset.name": "falcon",
+        "host.name": "hostnameofmachine",
         "input.type": "log",
         "log.flags": [
             "multiline"

diff --git a/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-events.log-expected.json b/x-pack/filebeat/module/crowdstrike/falcon/test/falcon-events.log-expected.json
@@ -61,6 +61,7 @@
         "file.hash.md5": "ac4c51eb24aa95b77f705ab159189e24",
         "file.hash.sha256": "6a671b92a69755de6fd063fcbe4ba926d83b49f78c42dbaeed8cdb6bbc57576a",
         "fileset.name": "falcon",
+        "host.name": "alice-laptop",
         "input.type": "log",
         "log.flags": [
             "multiline"