Use mapstr.M instead of common.MapStr

CHANGELOG-developer.next.asciidoc

@@ -60,6 +60,7 @@ The list below covers the major changes between 7.0.0-rc2 and main only.
 - libbeat.logp package forces ECS compliant logs. Logs are JSON formatted. Options to enable ECS/JSON have been removed. {issue}15544[15544] {pull}28573[28573]
 - Removed deprecated disk spool from Beats. Use disk queue instead. {pull}28869[28869]
 - Wildcard fields no longer have a default ignore_above setting of 1024. {issue}30096[30096] {pull}30668[30668]
+- Remove `common.MapStr` and use `mapstr.M` from `github.com/elastic/elastic-agent-libs` instead. {pull}31420[31420]
 
 ==== Bugfixes
 

auditbeat/cmd/root.go

@@ -24,11 +24,11 @@ import (
 	"github.com/elastic/beats/v7/auditbeat/core"
 	"github.com/elastic/beats/v7/libbeat/cmd"
 	"github.com/elastic/beats/v7/libbeat/cmd/instance"
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/ecs"
 	"github.com/elastic/beats/v7/libbeat/publisher/processing"
 	"github.com/elastic/beats/v7/metricbeat/beater"
 	"github.com/elastic/beats/v7/metricbeat/mb/module"
+	"github.com/elastic/elastic-agent-libs/mapstr"
 )
 
 const (
@@ -46,8 +46,8 @@ var ShowCmd = &cobra.Command{
 }
 
 // withECSVersion is a modifier that adds ecs.version to events.
-var withECSVersion = processing.WithFields(common.MapStr{
-	"ecs": common.MapStr{
+var withECSVersion = processing.WithFields(mapstr.M{
+	"ecs": mapstr.M{
 		"version": ecs.Version,
 	},
 })

auditbeat/core/eventmod.go

@@ -18,15 +18,15 @@
 package core
 
 import (
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/metricbeat/mb"
+	"github.com/elastic/elastic-agent-libs/mapstr"
 )
 
 // AddDatasetToEvent adds dataset information to the event. In particular this
 // adds the module name under dataset.module.
 func AddDatasetToEvent(module, metricSet string, event *mb.Event) {
 	if event.RootFields == nil {
-		event.RootFields = common.MapStr{}
+		event.RootFields = mapstr.M{}
 	}
 
 	event.RootFields.Put("event.module", module)

auditbeat/module/auditd/audit_linux.go

@@ -33,6 +33,7 @@ import (
 	"github.com/elastic/beats/v7/libbeat/monitoring"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	"github.com/elastic/beats/v7/metricbeat/mb/parse"
+	"github.com/elastic/elastic-agent-libs/mapstr"
 	"github.com/elastic/go-libaudit/v2"
 	"github.com/elastic/go-libaudit/v2/aucoalesce"
 	"github.com/elastic/go-libaudit/v2/auparse"
@@ -514,7 +515,7 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 	auditEvent, err := aucoalesce.CoalesceMessages(msgs)
 	if err != nil {
 		// Add messages on error so that it's possible to debug the problem.
-		out := mb.Event{RootFields: common.MapStr{}, Error: err}
+		out := mb.Event{RootFields: mapstr.M{}, Error: err}
 		addEventOriginal(msgs, out.RootFields)
 		return out
 	}
@@ -529,14 +530,14 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 	}
 	out := mb.Event{
 		Timestamp: auditEvent.Timestamp,
-		RootFields: common.MapStr{
-			"event": common.MapStr{
+		RootFields: mapstr.M{
+			"event": mapstr.M{
 				"category": auditEvent.Category.String(),
 				"action":   auditEvent.Summary.Action,
 				"outcome":  eventOutcome,
 			},
 		},
-		ModuleFields: common.MapStr{
+		ModuleFields: mapstr.M{
 			"message_type": strings.ToLower(auditEvent.Type.String()),
 			"sequence":     auditEvent.Sequence,
 			"result":       auditEvent.Result,
@@ -602,7 +603,7 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 	}
 
 	// Copy user.*/group.* fields from event
-	setECSEntity := func(key string, ent aucoalesce.ECSEntityData, root common.MapStr, set common.StringSet) {
+	setECSEntity := func(key string, ent aucoalesce.ECSEntityData, root mapstr.M, set common.StringSet) {
 		if ent.ID == "" && ent.Name == "" {
 			return
 		}
@@ -637,15 +638,15 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 			out.RootFields.Put("related.user", userSet.ToSlice())
 		}
 	}
-	getStringField := func(key string, m common.MapStr) (str string) {
+	getStringField := func(key string, m mapstr.M) (str string) {
 		if asIf, _ := m.GetValue(key); asIf != nil {
 			str, _ = asIf.(string)
 		}
 		return str
 	}
 
 	// Remove redundant user.effective.* when it's the same as user.*
-	removeRedundantEntity := func(target, original string, m common.MapStr) bool {
+	removeRedundantEntity := func(target, original string, m mapstr.M) bool {
 		for _, suffix := range []string{".id", ".name"} {
 			if value := getStringField(original+suffix, m); value != "" && getStringField(target+suffix, m) == value {
 				m.Delete(target)
@@ -658,7 +659,7 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 	return out
 }
 
-func normalizeEventFields(event *aucoalesce.Event, m common.MapStr) {
+func normalizeEventFields(event *aucoalesce.Event, m mapstr.M) {
 	m.Put("event.kind", "event")
 	if len(event.ECS.Event.Category) > 0 {
 		m.Put("event.category", event.ECS.Event.Category)
@@ -671,8 +672,8 @@ func normalizeEventFields(event *aucoalesce.Event, m common.MapStr) {
 	}
 }
 
-func addUser(u aucoalesce.User, m common.MapStr) {
-	user := common.MapStr{}
+func addUser(u aucoalesce.User, m mapstr.M) {
+	user := mapstr.M{}
 	m.Put("user", user)
 
 	for id, value := range u.IDs {
@@ -733,12 +734,12 @@ func addUser(u aucoalesce.User, m common.MapStr) {
 	}
 }
 
-func addProcess(p aucoalesce.Process, m common.MapStr) {
+func addProcess(p aucoalesce.Process, m mapstr.M) {
 	if p.IsEmpty() {
 		return
 	}
 
-	process := common.MapStr{}
+	process := mapstr.M{}
 	m.Put("process", process)
 	if p.PID != "" {
 		if pid, err := strconv.Atoi(p.PID); err == nil {
@@ -747,7 +748,7 @@ func addProcess(p aucoalesce.Process, m common.MapStr) {
 	}
 	if p.PPID != "" {
 		if ppid, err := strconv.Atoi(p.PPID); err == nil {
-			process["parent"] = common.MapStr{
+			process["parent"] = mapstr.M{
 				"pid": ppid,
 			}
 		}
@@ -769,12 +770,12 @@ func addProcess(p aucoalesce.Process, m common.MapStr) {
 	}
 }
 
-func addFile(f *aucoalesce.File, m common.MapStr) {
+func addFile(f *aucoalesce.File, m mapstr.M) {
 	if f == nil {
 		return
 	}
 
-	file := common.MapStr{}
+	file := mapstr.M{}
 	m.Put("file", file)
 	if f.Path != "" {
 		file["path"] = f.Path
@@ -805,12 +806,12 @@ func addFile(f *aucoalesce.File, m common.MapStr) {
 	}
 }
 
-func addAddress(addr *aucoalesce.Address, key string, m common.MapStr) {
+func addAddress(addr *aucoalesce.Address, key string, m mapstr.M) {
 	if addr == nil {
 		return
 	}
 
-	address := common.MapStr{}
+	address := mapstr.M{}
 	m.Put(key, address)
 	if addr.Hostname != "" {
 		address["domain"] = addr.Hostname
@@ -826,18 +827,18 @@ func addAddress(addr *aucoalesce.Address, key string, m common.MapStr) {
 	}
 }
 
-func addNetwork(net *aucoalesce.Network, m common.MapStr) {
+func addNetwork(net *aucoalesce.Network, m mapstr.M) {
 	if net == nil {
 		return
 	}
 
-	network := common.MapStr{
+	network := mapstr.M{
 		"direction": net.Direction,
 	}
 	m.Put("network", network)
 }
 
-func addEventOriginal(msgs []*auparse.AuditMessage, m common.MapStr) {
+func addEventOriginal(msgs []*auparse.AuditMessage, m mapstr.M) {
 	const key = "event.original"
 	if len(msgs) == 0 {
 		return
@@ -853,8 +854,8 @@ func addEventOriginal(msgs []*auparse.AuditMessage, m common.MapStr) {
 	m.Put(key, rawMsgs)
 }
 
-func createAuditdData(data map[string]string) common.MapStr {
-	out := make(common.MapStr, len(data))
+func createAuditdData(data map[string]string) mapstr.M {
+	out := make(mapstr.M, len(data))
 	for key, v := range data {
 		if strings.HasPrefix(key, "socket_") {
 			out.Put("socket."+key[7:], v)

auditbeat/module/auditd/audit_linux_test.go

@@ -34,11 +34,11 @@ import (
 	"github.com/prometheus/procfs"
 
 	"github.com/elastic/beats/v7/auditbeat/core"
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/logp"
 	"github.com/elastic/beats/v7/libbeat/mapping"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing"
+	"github.com/elastic/elastic-agent-libs/mapstr"
 	"github.com/elastic/go-libaudit/v2"
 	"github.com/elastic/go-libaudit/v2/auparse"
 )
@@ -138,7 +138,7 @@ func TestLoginType(t *testing.T) {
 			return events[i].ModuleFields["sequence"].(uint32) < events[j].ModuleFields["sequence"].(uint32)
 		})
 
-	for idx, expected := range []common.MapStr{
+	for idx, expected := range []mapstr.M{
 		{
 			"event.category":      []string{"authentication"},
 			"event.type":          []string{"start"},
@@ -175,7 +175,7 @@ func TestLoginType(t *testing.T) {
 				assert.Equal(t, v, cur, msg)
 			} else {
 				_, err := beatEvent.GetValue(k)
-				assert.Equal(t, common.ErrKeyNotFound, err, msg)
+				assert.Equal(t, mapstr.ErrKeyNotFound, err, msg)
 			}
 		}
 	}

auditbeat/module/auditd/golden_files_test.go

@@ -35,10 +35,10 @@ import (
 
 	"github.com/stretchr/testify/assert"
 
+	"github.com/elastic/elastic-agent-libs/mapstr"
 	"github.com/elastic/go-libaudit/v2"
 	"github.com/elastic/go-libaudit/v2/aucoalesce"
 
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	mbtest "github.com/elastic/beats/v7/metricbeat/mb/testing"
 )
@@ -88,7 +88,7 @@ func readLines(path string) (lines []string, err error) {
 	return lines, scanner.Err()
 }
 
-func readGoldenFile(t testing.TB, path string) (events []common.MapStr) {
+func readGoldenFile(t testing.TB, path string) (events []mapstr.M) {
 	data, err := ioutil.ReadFile(path)
 	if err != nil {
 		t.Fatalf("can't read golden file '%s': %v", path, err)
@@ -99,9 +99,9 @@ func readGoldenFile(t testing.TB, path string) (events []common.MapStr) {
 	return
 }
 
-func normalize(t testing.TB, events []mb.Event) (norm []common.MapStr) {
+func normalize(t testing.TB, events []mb.Event) (norm []mapstr.M) {
 	for _, ev := range events {
-		var output common.MapStr
+		var output mapstr.M
 		data, err := json.Marshal(ev.BeatEvent(moduleName, metricsetName).Fields)
 		if err != nil {
 			t.Fatal(err)

auditbeat/module/file_integrity/event.go

@@ -39,9 +39,9 @@ import (
 	"golang.org/x/crypto/blake2b"
 	"golang.org/x/crypto/sha3"
 
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/common/file"
 	"github.com/elastic/beats/v7/metricbeat/mb"
+	"github.com/elastic/elastic-agent-libs/mapstr"
 )
 
 // Source identifies the source of an event (i.e. what triggered it).
@@ -243,13 +243,13 @@ func getDriveLetter(path string) string {
 }
 
 func buildMetricbeatEvent(e *Event, existedBefore bool) mb.Event {
-	file := common.MapStr{
+	file := mapstr.M{
 		"path": e.Path,
 	}
 	out := mb.Event{
 		Timestamp: e.Timestamp,
 		Took:      e.rtt,
-		MetricSetFields: common.MapStr{
+		MetricSetFields: mapstr.M{
 			"file": file,
 		},
 	}
@@ -309,7 +309,7 @@ func buildMetricbeatEvent(e *Event, existedBefore bool) mb.Event {
 	}
 
 	if len(e.Hashes) > 0 {
-		hashes := make(common.MapStr, len(e.Hashes))
+		hashes := make(mapstr.M, len(e.Hashes))
 		for hashType, digest := range e.Hashes {
 			hashes[string(hashType)] = digest
 		}

auditbeat/module/file_integrity/event_test.go

@@ -31,7 +31,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/elastic/beats/v7/libbeat/common"
+	"github.com/elastic/elastic-agent-libs/mapstr"
 )
 
 var testEventTime = time.Now().UTC()
@@ -520,7 +520,7 @@ func mustDecodeHex(v string) []byte {
 	return data
 }
 
-func assertHasKey(t testing.TB, m common.MapStr, key string) bool {
+func assertHasKey(t testing.TB, m mapstr.M, key string) bool {
 	t.Helper()
 	found, err := m.HasKey(key)
 	if err != nil || !found {

filebeat/autodiscover/builder/hints/config_test.go

@@ -23,11 +23,12 @@ import (
 	"github.com/stretchr/testify/assert"
 
 	"github.com/elastic/beats/v7/libbeat/common"
+	"github.com/elastic/elastic-agent-libs/mapstr"
 )
 
 func TestUnpackCopiesDefault(t *testing.T) {
-	userCfg := common.MustNewConfigFrom(common.MapStr{
-		"default_config": common.MapStr{
+	userCfg := common.MustNewConfigFrom(mapstr.M{
+		"default_config": mapstr.M{
 			"type": "container",
 			"paths": []string{
 				"/var/log/containers/*${data.kubernetes.container.id}.log",