[Auditbeat] Namespace system module to system.audit #9499
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Pinging @elastic/secops |
andrewkroh
approved these changes
Dec 11, 2018
ruflin
reviewed
Dec 12, 2018
| @@ -29,6 +29,7 @@ import ( | |||
| const ( | |||
| moduleName = "system" | |||
| metricsetName = "host" | |||
| namespace = "system.audit.host" | |||
There was a problem hiding this comment.
My concern is that even with #8941 merged the dataset name here will still be system.host but should be system.audit.host. Do you want to keep it host as the name for the config?
There was a problem hiding this comment.
Maybe we need a way to specify a custom dataset name? {module}.{metricset} will be weird for Auditbeat:
- auditd will be
auditd.auditd - file_integrity will be
file_integrity.file
There was a problem hiding this comment.
++ on introducing a config / init option for it.
There was a problem hiding this comment.
+1. I'd say we merge this PR and make another one for the dataset?
webmat
approved these changes
Dec 12, 2018
cwurm
force-pushed
the
namespace_system_audit
branch
from
c367ebc
to
a5fdb09
Compare
cwurm
pushed a commit
to cwurm/beats
that referenced
this pull request
Dec 16, 2018
Namespaces all Auditbeat system module metricsets to `system.audit` to avoid any potential field clashes with Metricbeat.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
So far, the system module has been using the top-level
systemobject to store many of its fields (e.g.system.user.group.name), setting it up for potential clashes with the Metricbeat system module, which occupies the same top-level object.This change namespaces all metricsets to the
system.auditobject (e.g. nowsystem.audit.user.group.name), thus avoiding any potential field clashes - now and in the future.Auditbeat and Metricbeat are still using the same module and metricset names in their configurations.