Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix recently translated Filebeat modules where integer coercions were added #9598

Closed
14 tasks done
webmat opened this issue Dec 17, 2018 · 3 comments
Closed
14 tasks done
Assignees

Comments

@webmat
Copy link
Contributor

webmat commented Dec 17, 2018

Many of the recently Filebeat modules recently translated to ECS also added more integer coercion, for some of the fields that used to remain as strings (e.g. PID, port, etc).

This was done by adding :int in the grok expression, which may not be enough for all of these fields. We should review and use :long to perform the coercion where necessary.

Modules already merged, affected by this:

PRs already open, but not merged yet (should be fixed directly in their respective PRs):

This potential problem came up first here: #8963 (comment)

@ruflin
Copy link
Member

ruflin commented Dec 18, 2018

I suggest we move all of them to long as we also convert type: int in the fields.yml automatically to long.

@webmat
Copy link
Contributor Author

webmat commented Dec 18, 2018

Yes, I agree. I'm even doing that for HTTP status codes, which are very far from overflowing the capacity of a signed int. I'm going for the most straightforward approach possible: "Always use long, don't overthink it" 😂

@webmat
Copy link
Contributor Author

webmat commented Dec 21, 2018

All PRs in flight have been adjusted to use :long for integer coercions

@webmat webmat closed this as completed Dec 21, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants