Skip to content

Commit 37a5c99

Browse files
andrewkrohandrewkroh
authored
[pfsense] Format client.mac per ECS (elastic#3303)
* Format client.mac per ECS * Sort ecs.yml [git-generate] cd packages/pfsense yq -i '. | sort_by(.name) | sort_keys(..)' data_stream/log/fields/ecs.yml * Use ECS source.geo.location definition * Remove duplicated client.geo.country_iso_code field * Remove duplicated pfsense.icmp.{id,seq} fields * Updates sample_event.json * Update readme and generated test files [git-generate] cd packages/pfsense elastic-package build elastic-package test pipeline -g * Update changelog [git-generate] elastic-package-changelog add-next --pr 3303 --type bug --description "Format client.mac as per ECS."
1 parent daab24d commit 37a5c99

9 files changed

Lines changed: 309 additions & 298 deletions

File tree

‎packages/pfsense/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.0.1"
3+
changes:
4+
- description: Format client.mac as per ECS.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/3303
27
- version: "1.0.0"
38
changes:
49
- description: Add OPNsense support. Add PHP-FPM log parsing.

‎packages/pfsense/data_stream/log/_dev/test/pipeline/test-opensense.log-expected.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -194,7 +194,7 @@
194194
{
195195
"@timestamp": "2022-12-31T22:06:16.000-04:00",
196196
"client": {
197-
"mac": "4c:55:41:a0:fa:99",
197+
"mac": "4C-55-41-A0-FA-99",
198198
"port": 68
199199
},
200200
"destination": {
@@ -249,7 +249,7 @@
249249
"port": 67
250250
},
251251
"source": {
252-
"mac": "4c:55:41:a0:fa:99",
252+
"mac": "4C-55-41-A0-FA-99",
253253
"port": 68
254254
},
255255
"tags": [

‎packages/pfsense/data_stream/log/_dev/test/pipeline/test-pfsense-dhcp.log-expected.json‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
{
44
"@timestamp": "2022-07-04T09:39:40.000-04:00",
55
"client": {
6-
"mac": "4c:55:41:a0:fa:99",
6+
"mac": "4C-55-41-A0-FA-99",
77
"port": 68
88
},
99
"destination": {
@@ -57,7 +57,7 @@
5757
"port": 67
5858
},
5959
"source": {
60-
"mac": "4c:55:41:a0:fa:99",
60+
"mac": "4C-55-41-A0-FA-99",
6161
"port": 68
6262
},
6363
"tags": [
@@ -69,7 +69,7 @@
6969
"client": {
7070
"address": "10.150.60.56",
7171
"ip": "10.150.60.56",
72-
"mac": "4c:55:41:a0:fa:99",
72+
"mac": "4C-55-41-A0-FA-99",
7373
"port": 68
7474
},
7575
"destination": {
@@ -135,7 +135,7 @@
135135
"source": {
136136
"address": "10.150.60.56",
137137
"ip": "10.150.60.56",
138-
"mac": "4c:55:41:a0:fa:99",
138+
"mac": "4C-55-41-A0-FA-99",
139139
"port": 68
140140
},
141141
"tags": [
@@ -147,7 +147,7 @@
147147
"client": {
148148
"address": "10.150.60.56",
149149
"ip": "10.150.60.56",
150-
"mac": "4c:55:41:a0:fa:99",
150+
"mac": "4C-55-41-A0-FA-99",
151151
"port": 68
152152
},
153153
"destination": {
@@ -219,7 +219,7 @@
219219
"source": {
220220
"address": "10.150.60.56",
221221
"ip": "10.150.60.56",
222-
"mac": "4c:55:41:a0:fa:99",
222+
"mac": "4C-55-41-A0-FA-99",
223223
"port": 68
224224
},
225225
"tags": [
@@ -231,7 +231,7 @@
231231
"client": {
232232
"address": "10.150.60.56",
233233
"ip": "10.150.60.56",
234-
"mac": "4c:55:41:a0:fa:99",
234+
"mac": "4C-55-41-A0-FA-99",
235235
"port": 68
236236
},
237237
"destination": {
@@ -297,7 +297,7 @@
297297
"source": {
298298
"address": "10.150.60.56",
299299
"ip": "10.150.60.56",
300-
"mac": "4c:55:41:a0:fa:99",
300+
"mac": "4C-55-41-A0-FA-99",
301301
"port": 68
302302
},
303303
"tags": [

‎packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,14 @@ processors:
5454
field: server.ip
5555
value: "{{server.address}}"
5656
ignore_empty_value: true
57+
- uppercase:
58+
field: client.mac
59+
ignore_missing: true
60+
- gsub:
61+
field: client.mac
62+
pattern: '[:]'
63+
replacement: '-'
64+
ignore_missing: true
5765
- set:
5866
field: source
5967
copy_from: client

0 commit comments

Comments
 (0)