Use new httpjson template delimiters for defender atp (#23057)

elastic · Dec 11, 2020 · 12cd7af · 12cd7af
1 parent ce73772
commit 12cd7af
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 9 deletions.
diff --git a/x-pack/filebeat/module/microsoft/defender_atp/config/atp.yml b/x-pack/filebeat/module/microsoft/defender_atp/config/atp.yml
@@ -20,8 +20,8 @@ request.transforms:
       value: evidence
   - set:
       target: "url.params.$filter"
-      value: {{.date_cursor.value_template}}
-      default: {{.date_cursor.default_template}}
+      value: 'lastUpdateTime gt [[formatDate .cursor.lastUpdateTime "2006-01-02T15:04:05.9999999Z"]]'
+      default: 'lastUpdateTime gt [[formatDate (now (parseDuration "-5m")) "2006-01-02T15:04:05.9999999Z"]]'
 
 response.split:
   target: body.value
@@ -31,7 +31,7 @@ response.split:
 
 cursor:
   lastUpdateTime:
-    value: "{{.date_cursor.cursor_template}}"
+    value: "[[.last_response.body.lastUpdateTime]]"
 
 {{ else if eq .input "file" }}
 

diff --git a/x-pack/filebeat/module/microsoft/defender_atp/manifest.yml b/x-pack/filebeat/module/microsoft/defender_atp/manifest.yml
@@ -5,16 +5,10 @@ var:
     default: httpjson
   - name: interval
     default: 5m
-  - name: date_cursor
-    default:
-      cursor_template: "{{.last_response.body.lastUpdateTime}}"
-      value_template: 'lastUpdateTime gt {{formatDate .cursor.lastUpdateTime "2006-01-02T15:04:05.9999999Z"}}'
-      default_template: 'lastUpdateTime gt {{formatDate (now (parseDuration "-5m")) "2006-01-02T15:04:05.9999999Z"}}'
   - name: tags
     default: [defender-atp, forwarded]
   - name: oauth2
 
-
 ingest_pipeline: ingest/pipeline.yml
 input: config/atp.yml