Skip to content

[microsoft_dhcp] Format observer.mac per ECS #3300

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andrewkroh merged 6 commits into from
May 10, 2022
Merged

[microsoft_dhcp] Format observer.mac per ECS #3300

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
798ae25
Sort ecs.yml
andrewkroh May 9, 2022
a378835
Add missing event field mappings
andrewkroh May 9, 2022
5d5540a
Format observer.mac field
andrewkroh May 9, 2022
82c2214
Update sample event
andrewkroh May 9, 2022
eb53335
Update generated readme
andrewkroh May 9, 2022
382fab7
Add changelog
andrewkroh May 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Format observer.mac field 
Format the field per ECS guidance (uppercase hex, dash separated).
  • Loading branch information
@andrewkroh
andrewkroh committed May 9, 2022
commit 5d5540ae7be04abc398e3eb7bba0ab201290299e
14 changes: 14 additions & 0 deletions packages/microsoft_dhcp/data_stream/log/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,20 @@ processors:
- pipeline:
name: '{{ IngestPipeline "dhcpv6" }}'
if: "ctx?.log?.file?.path != null && ctx.log.file.path.contains('V6')"
- foreach:
field: observer.mac
ignore_missing: true
processor:
gsub:
field: _ingest._value
pattern: '[:]'
replacement: '-'
- foreach:
field: observer.mac
ignore_missing: true
processor:
uppercase:
field: _ingest._value
- remove:
field: event.original
if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))"
Expand Down