Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Workaround for Beats issue with default_field growing too big #687

Merged
merged 9 commits into from
Dec 23, 2019
Merged

Workaround for Beats issue with default_field growing too big #687

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
c42bf99
Add default_field option for Beats generator
adriansr Dec 10, 2019
6b9bfb0
Update CHANGELOG.next.md
adriansr Dec 12, 2019
433f8b1
Rename option to beats.default_field
adriansr Dec 12, 2019
ef2da98
Disable default for all fields introduced in ECS 1.3.x
adriansr Dec 13, 2019
2bbebc0
Unset default_field on more new fields
adriansr Dec 13, 2019
a8d81fb
Document beats keys
adriansr Dec 16, 2019
a946651
Merge branch 'master' into beats_default_fields
Dec 20, 2019
02b992e
Move the Beats 'default_field' workaround to the Beats generator
Dec 20, 2019
97c9ef7
Adjust the changelog
Dec 20, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.next.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ Thanks, you're awesome :-) -->

#### Improvements

* Temporary workaround for Beats templates' `default_field` growing too big. #687

#### Deprecated


Expand Down
4 changes: 2 additions & 2 deletions code/go/ecs/host.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion code/go/ecs/rule.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions docs/field-details.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2001,9 +2001,9 @@ example: `x86_64`
// ===============================================================

| host.domain
| Name of the domain of which the host is a member.
| Name of the domain of which the host is a member.

For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.
For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.

type: keyword

Expand Down Expand Up @@ -3671,7 +3671,7 @@ type: keyword

Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.

Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.

==== Rule Field Details

Expand Down