Filebeat: add TLS + pipeline options to checkpoint module #18116
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually? |
1 similar comment
|
Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually? |
botelastic
bot
added
the
needs_team
|
💚 CLA has been signed |
❕ Build Aborted
Expand to view the summary
Build stats
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
jsoriano
added
[zube]: In Review
enhancement
module
review
Team:SIEM
and removed
needs_team
|
Pinging @elastic/siem (Team:SIEM) |
|
Hey @hazcod, thanks for your contribution! You will need to sign the CLA so we can merge it https://www.elastic.co/contributor-agreement |
|
Hmm I thought I did, will try again. |
|
jenkins test this |
|
I ran |
|
Can we get this merged? |
|
Ping. |
❕ Build Aborted
Expand to view the summary
Build stats
Steps errorsExpand to view the steps failures
Log outputExpand to view the last 100 lines of log output
|
|
Thanks for contribution. Can you please rebase this on master to try to fix the changeset, it's really large at the moment:
|
|
Hmm @andrewkroh , any idea how I would do that? |
andrewstucki
reviewed
Jun 5, 2020
| @@ -0,0 +1,100 @@ | |||
| // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | |||
| // or more contributor license agreements. Licensed under the Elastic License; | |||
| // you may not use this file except in compliance with the Elastic License. | |||
There was a problem hiding this comment.
@hazcod / @andrewkroh : So I'm not entirely sure how these files got here, but it looks like a bunch of the x-pack inputs for filebeat were copied over into the non-x-pack folder and then the generator was run, resulting in the huge changeset.
We try and keep a strict separation between Elastic licensed code and the Apache-licensed stuff (with the Elastic licensed stuff in the x-pack directory), so these files should not be moved or copied around. Here's the commit where this happened: bb64918.
Since this is core to our project structure and our licensing model, you're likely going to need to revert that commit and fix up the rest of your contribution without it before we can accept it.
There was a problem hiding this comment.
Ah yes, I believe the reason was that the checkpoint module needs to be moved to be able to compile the module.
There was a problem hiding this comment.
@hazcod -- so if you're modifying files in the x-pack directory you should still be able to compile/test using the x-pack entrypoint. The way these binaries work is that the Apache-licensed binary entrypoint is basically the filebeat/cmd sub-package. The x-pack/filebeat/cmd sub-package wraps the Apache-licensed entrypoint and includes all of the Elastic-licensed modules.
The Elastic-licensed binary we distribute is here: https://www.elastic.co/downloads/beats/filebeat, while the Apache-licensed binary, without the Elastic-licensed code is here: https://www.elastic.co/downloads/beats/filebeat-oss
So if you're trying to build or test changes involving the Elastic-licensed code, you'll just need to work in the x-pack/filebeat directory rather than filebeat directly. The make/mage commands for building and testing should be pretty much the same.
There was a problem hiding this comment.
Seems like i compiled that wrong, I will open up a new PR this weekend.
|
Closing in favor of #19560 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This adds a
var.inputtypetls, which will use tcp + tls for mutual TLS authentication.Why is it important?
Syslog udp is plaintext and does not guarantee CIA.
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Related issues
#17682
CC @P1llus @adriansr