Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Winlogbeat escaping CRLF sequences #11357

Merged
merged 4 commits into from Mar 21, 2019

Conversation

Projects
None yet
2 participants
@adriansr
Copy link
Member

commented Mar 21, 2019

Previous fix (#11006) made Winlogbeat escape CRLF control characters, which are expected in Windows event logs.

Fixes #11328

Fix Winlogbeat escaping CRLF sequences
Previous fix (#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes #11328

@adriansr adriansr requested a review from elastic/beats as a code owner Mar 21, 2019

@adriansr adriansr added the review label Mar 21, 2019

if !assert.NoError(t, err) {
assert.Equal(t, err.Error(), "XML syntax error on line 6: illegal character code U+001B")
}
evXML := strings.Replace(allXML, "%1", "
\n\x1b", -1)

This comment has been minimized.

Copy link
@andrewkroh

andrewkroh Mar 21, 2019

Member

I think including other whitespace characters would be good too since \t is used a lot in event logs.

This comment has been minimized.

Copy link
@andrewkroh

andrewkroh Mar 21, 2019

Member

What was the story with the \r? I see you had to use 
. Is it because of https://www.w3.org/TR/REC-xml/#sec-line-ends?

This comment has been minimized.

Copy link
@adriansr

adriansr Mar 21, 2019

Author Member

Yep, the XML parser was getting rid of it.

self.assertNotIn("event.original", evts[0], evts[0])
self.assertIn("message", evts[0], evts[0])
self.assertNotIn("\\u000a", evts[0]["message"])
self.assertEqual(unicode(msg), evts[0]["message"].decode('unicode-escape'), evts[0])

This comment has been minimized.

Copy link
@andrewkroh

andrewkroh Mar 21, 2019

Member

Need to read some python docs before I can fully understand this stuff. But I get the gist.

adriansr added some commits Mar 21, 2019

@adriansr

This comment has been minimized.

Copy link
Member Author

commented Mar 21, 2019

jenkins, test this

@andrewkroh
Copy link
Member

left a comment

LGTM.

@adriansr adriansr merged commit 6865403 into elastic:master Mar 21, 2019

2 of 5 checks passed

beats-ci Build started for merge commit.
Details
continuous-integration/jenkins/pr-merge This commit is being built
Details
continuous-integration/travis-ci/pr The Travis CI build is in progress
Details
CLA All commits in pull request signed
Details
Hound No violations found. Woof!

adriansr added a commit to adriansr/beats that referenced this pull request Mar 21, 2019

Fix Winlogbeat escaping CRLF and TAB characters (elastic#11357)
Previous fix (elastic#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes elastic#11328

(cherry picked from commit 6865403)

@adriansr adriansr added v6.7.0 and removed needs_backport labels Mar 21, 2019

adriansr added a commit that referenced this pull request Mar 21, 2019

Fix Winlogbeat escaping CRLF and TAB characters (#11357) (#11369)
Previous fix (#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes #11328

(cherry picked from commit 6865403)

adriansr added a commit to adriansr/beats that referenced this pull request Mar 21, 2019

Fix Winlogbeat escaping CRLF and TAB characters (elastic#11357)
Previous fix (elastic#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes elastic#11328

(cherry picked from commit 6865403)

@adriansr adriansr added the v6.6.3 label Mar 21, 2019

adriansr added a commit to adriansr/beats that referenced this pull request Mar 21, 2019

Fix Winlogbeat escaping CRLF and TAB characters (elastic#11357)
Previous fix (elastic#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes elastic#11328

(cherry picked from commit 6865403)

adriansr added a commit to adriansr/beats that referenced this pull request Mar 21, 2019

Fix Winlogbeat escaping CRLF and TAB characters (elastic#11357)
Previous fix (elastic#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes elastic#11328

(cherry picked from commit 6865403)

adriansr added a commit to adriansr/beats that referenced this pull request Mar 21, 2019

Fix Winlogbeat escaping CRLF and TAB characters (elastic#11357)
Previous fix (elastic#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes elastic#11328

(cherry picked from commit 6865403)

@adriansr adriansr added the v7.0.0 label Mar 21, 2019

adriansr added a commit that referenced this pull request Mar 21, 2019

Fix Winlogbeat escaping CRLF and TAB characters (#11357) (#11373)
Previous fix (#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes #11328

(cherry picked from commit 6865403)

adriansr added a commit that referenced this pull request Mar 22, 2019

Cherry-pick #11357 to 5.6: Fix Winlogbeat escaping CRLF sequences (#1…
…1372)

Previous fix (#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes #11328

(cherry picked from commit 6865403)

adriansr added a commit to adriansr/beats that referenced this pull request Mar 25, 2019

[Winlogbeat] fix system test failure
The new system test added in elastic#11357 checks for the wrong field
in 6.7 and 6.6.

adriansr added a commit that referenced this pull request Mar 25, 2019

[Winlogbeat] fix system test failure (#11422)
The new system test added in #11357 checks for the wrong field
in 6.7 and 6.6.

adriansr added a commit to adriansr/beats that referenced this pull request Mar 25, 2019

[Winlogbeat] fix system test failure (elastic#11422)
The new system test added in elastic#11357 checks for the wrong field
in 6.7 and 6.6.

adriansr added a commit that referenced this pull request Mar 28, 2019

Cherry-pick #11357 to 6.6: Fix Winlogbeat escaping CRLF sequences (#1…
…1370)

Previous fix (#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes #11328

(cherry picked from commit 6865403)

DebashisMondal added a commit to DebashisMondal/beats that referenced this pull request May 10, 2019

Fix Winlogbeat escaping CRLF and TAB characters (elastic#11357)
Previous fix (elastic#11006) made Winlogbeat escape CRLF control characters
which are expected in Windows event logs.

Fixes elastic#11328
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.