Convert the Filebeat auditd module to ECS

CHANGELOG.next.asciidoc

@@ -44,6 +44,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Rename a few `mongodb.*` fields to map to ECS. {pull}10009[10009]
 - Rename a few `mysql.*` fields to map to ECS. {pull}10008[10008]
 - Rename a few `nginx.error.*` fields to map to ECS. {pull}10007[10007]
+- Rename many `auditd.log.*` fields to map to ECS. {pull}10192[10192]
 - Filesets with multiple ingest pipelines added in {pull}8914[8914] only work with Elasticsearch >= 6.5.0 {pull}10001[10001]
 - Remove service.name from Elastcsearch module. Replace by service.type. {pull}10042[10042]
 - Remove numeric coercions for `user.id` and `group.id`. IDs should be `keyword`. {pull}10233[10233]
@@ -161,6 +162,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add alias field support in Kibana index pattern. {pull}10075[10075]
 - Add `add_fields` processor. {pull}10119[10119]
 - Add Kibana field formatter to bytes fields. {pull}10184[10184]
+- Document a few more `auditd.log.*` fields. {pull}10192[10192]
 
 *Auditbeat*
 

dev-tools/ecs-migration.yml

@@ -129,6 +129,159 @@
 
 # Filebeat modules
 
+# Auditd module
+
+- from: auditd.log.acct
+  to: user.name
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.pid
+  to: process.pid
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.ppid
+  to: process.ppid
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.res
+  to: event.outcome
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.record_type
+  to: event.action
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.arch
+  to: host.architecture
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.gid
+  to: user.group.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.uid
+  to: user.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.agid
+  to: user.audit.group.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.auid
+  to: user.audit.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.fsgid
+  to: user.filesystem.group.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.egid
+  to: user.effective.group.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.euid
+  to: user.effective.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.sgid
+  to: user.saved.group.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.suid
+  to: user.saved.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.ogid
+  to: user.owner.group.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.ouid
+  to: user.owner.id
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.terminal
+  to: user.terminal
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.comm
+  to: process.name
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.cmd
+  to: process.args
+  alias: false
+  beat: filebeat
+  comment: Was a cmdline string, whereas args is an array of keywords.
+
+- from: auditd.log.exe
+  to: process.executable
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.msg
+  to: message
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.src
+  to: source.address
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.dst
+  to: destination.address
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.geoip.continent_name
+  to: source.geo.continent_name
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.geoip.country_iso_code
+  to: source.geo.country_iso_code
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.geoip.location
+  to: source.geo.location
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.geoip.region_name
+  to: source.geo.region_name
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.geoip.city_name
+  to: source.geo.city_name
+  alias: true
+  beat: filebeat
+
+- from: auditd.log.geoip.region_iso_code
+  to: source.geo.region_iso_code
+  alias: true
+  beat: filebeat
+
 # Suricata module
 
 - from: source_ecs.ip