Skip to content

Commit 004dafd

Browse files
efd6efd6
authored
network_traffic: remove invalid "network_traffic" terms from event.category (#3384)
1 parent 7fc362c commit 004dafd

14 files changed

Lines changed: 174 additions & 1 deletion

File tree

‎packages/network_traffic/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.0.1"
3+
changes:
4+
- description: Remove invalid value from `event.category`.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/3384
27
- version: "1.0.0"
38
changes:
49
- description: Release as GA.

‎packages/network_traffic/data_stream/amqp/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

‎packages/network_traffic/data_stream/cassandra/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

‎packages/network_traffic/data_stream/dhcpv4/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,20 @@ processors:
3434
- uppercase:
3535
field: host.mac
3636
ignore_missing: true
37+
- script:
38+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
39+
# This string-based comparison is valid while versions are below v10.x.
40+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
41+
lang: painless
42+
source: >
43+
if (ctx.event?.category != null) {
44+
for (int i=ctx.event.category.length-1; i>=0; i--) {
45+
if (ctx.event.category[i] == "network_traffic") {
46+
ctx.event.category.remove(i);
47+
}
48+
}
49+
}
50+
3751
on_failure:
3852
- set:
3953
field: error.message

‎packages/network_traffic/data_stream/dns/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

‎packages/network_traffic/data_stream/http/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

‎packages/network_traffic/data_stream/icmp/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

‎packages/network_traffic/data_stream/memcached/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

‎packages/network_traffic/data_stream/mongodb/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

‎packages/network_traffic/data_stream/mysql/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,20 @@ processors:
2121
- uppercase:
2222
field: host.mac
2323
ignore_missing: true
24+
- script:
25+
description: Remove invalid "network_traffic" term added by packetbeat prior to v8.
26+
# This string-based comparison is valid while versions are below v10.x.
27+
if: 'ctx.agent?.version == null || ctx.agent.version.compareTo("8.") < 0'
28+
lang: painless
29+
source: >
30+
if (ctx.event?.category != null) {
31+
for (int i=ctx.event.category.length-1; i>=0; i--) {
32+
if (ctx.event.category[i] == "network_traffic") {
33+
ctx.event.category.remove(i);
34+
}
35+
}
36+
}
37+
2438
on_failure:
2539
- set:
2640
field: error.message

0 commit comments

Comments
 (0)