Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cherry-pick #21063 to 7.x: [Filebeat] Add Pensando DFW Module #24045

Merged
merged 1 commit into from
Feb 16, 2021

Conversation

marc-gr
Copy link
Contributor

@marc-gr marc-gr commented Feb 15, 2021

Cherry-pick of PR #21063 to 7.x branch. Original message:

  • Enhancement

What does this PR do?

Utilized the instructions found here: https://www.elastic.co/guide/en/beats/devguide/current/filebeat-modules-devguide.html
This adds the Pensando distributed firewall (fileset) beat to the release.

Why is it important?

Many of our customers want an easy way to implement our FW logging in/on their Elastic instances.

Checklist

  • My code follows the style guidelines of this project
    - [ ] I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

  • All files are in the correct place (dashboards, docs, module files, etc.)

How to test this PR locally

All tests were run using these guidelines to verify logs worked correctly: https://www.elastic.co/guide/en/beats/devguide/current/filebeat-modules-devguide.html#_test

Related issues

None

Use cases

Screenshots

Logs

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Feb 15, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Feb 15, 2021
@elasticmachine
Copy link
Collaborator

elasticmachine commented Feb 15, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #24045 updated

  • Start Time: 2021-02-16T08:50:28.027+0000

  • Duration: 49 min 42 sec

  • Commit: 3c5ab4d

Test stats 🧪

Test Results
Failed 0
Passed 13006
Skipped 2061
Total 15067

Trends 🧪

Image of Build Times

Image of Tests

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 13006
Skipped 2061
Total 15067

Copy link
Contributor

@leehinman leehinman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

* Add Pensando module init

* explicitly define the ECS version per testing

* updates to docs from make update

* updates for pensando module

* updates to documentation and db screenshot

* add dashboard export to repo

* update to add pensando beat

* Update filebeat/module/pensando/dfw/config/dfw.yml

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

* Update pipeline.yml

Condensed all "remove" fields to 1 list of fields.

* Update pipeline.yml

Do not remove the payload_raw field.

* Update filebeat/module/pensando/_meta/docs.asciidoc

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

* Update config.yml

Added syslog_host and syslog_port values as suggested.

* Update docs.asciidoc

Added documentation for syslog_host and syslog_port as suggested.

* Update pipeline.yml

Removing payload_raw - this and json are, essentially, the same field and no longer needed after parsing.

* Update pipeline.yml

Changed checks if values are != null to use the filebeat specific ignore_empty_value: true instead.

* Remove set of event.module

Remove the set param for event.module.  Filebeat should add this automatically.

* Apply suggestions from code review

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

* Update test.log

* Use convert instead of set for some fields

Changed ECS sets for IP addresses and ports to converts of type ip and
integer respectively.

* Updates for geoip and autonomous system

* add pensando dfw fields

* fixes from make -C filebeat update

* fixes for filebeat check

* make update changes

* Update filebeat/module/pensando/dfw/config/dfw.yml

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

* Update filebeat/module/pensando/dfw/ingest/pipeline.yml

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

* Update filebeat/module/pensando/dfw/ingest/pipeline.yml

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

* Update filebeat/module/pensando/dfw/ingest/pipeline.yml

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

* Update filebeat/module/pensando/dfw/ingest/pipeline.yml

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

* remove old json file

* ran tests

* Update filebeat/module/pensando/dfw/ingest/pipeline.yml

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>

* gen after run of 'mage -v pythonIntegTest'

* Update fields.yml

* mage fmt update request

Co-authored-by: Marc Guasch <marc-gr@users.noreply.github.com>
Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
(cherry picked from commit 4194408)
@marc-gr marc-gr merged commit 73af5b5 into elastic:7.x Feb 16, 2021
@marc-gr marc-gr deleted the backport_21063_7.x branch February 16, 2021 09:44
@zube zube bot removed the [zube]: Done label May 17, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants