Update ECS version to 1.12

elastic · Sep 29, 2021 · 6b4d1ac · 6b4d1ac
1 parent 96b92e0
commit 6b4d1ac
Show file tree

Hide file tree

Showing 80 changed files with 512 additions and 1,051 deletions.
diff --git a/packages/aws/_dev/build/build.yml b/packages/aws/_dev/build/build.yml
@@ -1,3 +1,3 @@
 dependencies:
   ecs:
-    reference: git@1.11
+    reference: git@1.12
diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.1.0"
+  changes:
+    - description: Update to ECS 1.12.0
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1687
 - version: "1.0.0"
   changes:
     - description: Release AWS as GA

diff --git a/packages/aws/data_stream/billing/fields/ecs.yml b/packages/aws/data_stream/billing/fields/ecs.yml
@@ -1,60 +1,24 @@
-- fields:
-    - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment.
-
-        Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.'
-      ignore_above: 1024
-      level: extended
-      name: account.id
-      type: keyword
-    - description: 'The cloud account name or alias used to identify different entities in a multi-tenant environment.
-
-        Examples: AWS account name, Google Cloud ORG display name.'
-      ignore_above: 1024
-      level: extended
-      name: account.name
-      type: keyword
-    - description: Availability zone in which this host is running.
-      ignore_above: 1024
-      level: extended
-      name: availability_zone
-      type: keyword
-    - description: Instance ID of the host machine.
-      ignore_above: 1024
-      level: extended
-      name: instance.id
-      type: keyword
-    - description: Machine type of the host machine.
-      ignore_above: 1024
-      level: extended
-      name: machine.type
-      type: keyword
-    - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.
-      ignore_above: 1024
-      level: extended
-      name: provider
-      type: keyword
-    - description: Region in which this host is running.
-      ignore_above: 1024
-      level: extended
-      name: region
-      type: keyword
-  footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.'
-  group: 2
+- external: ecs
   name: cloud
-  title: Cloud
-  type: group
-- description: ECS version this event conforms to.
-  example: 1.0.0
-  ignore_above: 1024
+- external: ecs
+  name: cloud.account.id
+- external: ecs
+  name: cloud.account.name
+- external: ecs
+  name: cloud.availability_zone
+- external: ecs
+  name: cloud.instance.id
+- external: ecs
+  name: cloud.machine.type
+- external: ecs
+  name: cloud.provider
+- external: ecs
+  name: cloud.region
+- external: ecs
   name: ecs.version
-  type: keyword
-- fields:
-    - description: Error message.
-      level: core
-      name: message
-      type: text
+- external: ecs
   name: error
-  type: group
-- description: Service type
+- external: ecs
+  name: error.message
+- external: ecs
   name: service.type
-  type: keyword
diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2014-03-25T21:08:14.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json b/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json
@@ -9,7 +9,7 @@
             },
             "@timestamp": "2019-10-02T22:12:29.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "source": {
                 "geo": {

diff --git a/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json b/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-09T00:09:33.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [
@@ -84,7 +84,7 @@
             },
             "@timestamp": "2020-01-09T00:03:36.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log-expected.json
@@ -14,7 +14,7 @@
             },
             "@timestamp": "2020-09-11T19:36:49.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "hash": [

diff --git a/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json b/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2014-07-16T15:49:27.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [
@@ -101,7 +101,7 @@
             },
             "@timestamp": "2014-07-08T17:35:27.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [
@@ -180,7 +180,7 @@
             },
             "@timestamp": "2014-07-08T17:35:27.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "source": {
                 "address": "192.0.2.100",

diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-08T20:43:06.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-09T01:48:44.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [
@@ -105,7 +105,7 @@
             },
             "@timestamp": "2020-01-09T02:22:03.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json b/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json
@@ -34,7 +34,7 @@
             },
             "@timestamp": "2014-03-06T17:10:34.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-08T15:30:25.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json b/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2014-03-24T21:11:59.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...tream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json b/...tream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2019-11-27T15:10:15.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...ta_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json b/...ta_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-10T00:34:02.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-delete-access-key-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-delete-access-key-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-08T19:09:36.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json b/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json
@@ -9,7 +9,7 @@
             },
             "@timestamp": "2016-11-14T17:25:45.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "source": {
                 "address": "192.0.2.1",

diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-group-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-group-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-09T02:25:44.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [
@@ -94,7 +94,7 @@
             },
             "@timestamp": "2020-01-09T02:25:11.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...ta_stream/cloudtrail/_dev/test/pipeline/test-delete-ssh-public-key-json.log-expected.json b/...ta_stream/cloudtrail/_dev/test/pipeline/test-delete-ssh-public-key-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-10T16:07:08.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-trail-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-trail-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-09T20:09:51.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-user-json.log-expected.json b/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-user-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-03T15:50:52.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...tream/cloudtrail/_dev/test/pipeline/test-delete-virtual-mfa-device-json.log-expected.json b/...tream/cloudtrail/_dev/test/pipeline/test-delete-virtual-mfa-device-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-10T00:34:02.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-enable-mfa-device-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-enable-mfa-device-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2019-11-27T15:11:09.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-insight-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-insight-json.log-expected.json
@@ -6,7 +6,7 @@
             },
             "@timestamp": "2020-09-09T23:00:00.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "event": {
                 "ingested": "2021-07-19T21:47:03.810147500Z",

diff --git a/...a_stream/cloudtrail/_dev/test/pipeline/test-remove-user-from-group-json.log-expected.json b/...a_stream/cloudtrail/_dev/test/pipeline/test-remove-user-from-group-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-06T15:19:50.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-logging-json.log-expected.json b/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-logging-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-08T15:30:25.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-logging-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-logging-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-09T16:46:16.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-update-access-key-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-update-access-key-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-10T15:01:23.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...m/cloudtrail/_dev/test/pipeline/test-update-accout-password-policy-json.log-expected.json b/...m/cloudtrail/_dev/test/pipeline/test-update-accout-password-policy-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-10T18:05:33.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [

diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-group-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-group-json.log-expected.json
@@ -16,7 +16,7 @@
             },
             "@timestamp": "2020-01-09T02:23:11.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [
@@ -91,7 +91,7 @@
             },
             "@timestamp": "2020-01-09T02:24:35.000Z",
             "ecs": {
-                "version": "1.11.0"
+                "version": "1.12.0"
             },
             "related": {
                 "user": [