Exclude new zeek datasets from default_field list

elastic · Oct 30, 2019 · 33c3573 · 33c3573
1 parent 52694fb
commit 33c3573
Show file tree

Hide file tree

Showing 31 changed files with 31 additions and 1 deletion.
diff --git a/x-pack/filebeat/module/zeek/connection/_meta/fields.yml b/x-pack/filebeat/module/zeek/connection/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: connection
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek Connection log
   fields:

diff --git a/x-pack/filebeat/module/zeek/dce_rpc/_meta/fields.yml b/x-pack/filebeat/module/zeek/dce_rpc/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: dce_rpc
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek DCE_RPC log
   fields:

diff --git a/x-pack/filebeat/module/zeek/dhcp/_meta/fields.yml b/x-pack/filebeat/module/zeek/dhcp/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: dhcp
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek DHCP log
   fields:

diff --git a/x-pack/filebeat/module/zeek/dnp3/_meta/fields.yml b/x-pack/filebeat/module/zeek/dnp3/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: dnp3
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SSH log
   fields:

diff --git a/x-pack/filebeat/module/zeek/dpd/_meta/fields.yml b/x-pack/filebeat/module/zeek/dpd/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: dpd
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek DPD log
   fields:

diff --git a/x-pack/filebeat/module/zeek/fields.go b/x-pack/filebeat/module/zeek/fields.go
diff --git a/x-pack/filebeat/module/zeek/ftp/_meta/fields.yml b/x-pack/filebeat/module/zeek/ftp/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: ftp
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek FTP log
   fields:

diff --git a/x-pack/filebeat/module/zeek/irc/_meta/fields.yml b/x-pack/filebeat/module/zeek/irc/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: irc
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek IRC log
   fields:

diff --git a/x-pack/filebeat/module/zeek/kerberos/_meta/fields.yml b/x-pack/filebeat/module/zeek/kerberos/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: kerberos
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek Kerberos log
   fields:

diff --git a/x-pack/filebeat/module/zeek/modbus/_meta/fields.yml b/x-pack/filebeat/module/zeek/modbus/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: modbus
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek modbus log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/mysql/_meta/fields.yml b/x-pack/filebeat/module/zeek/mysql/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: mysql
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek MySQL log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/ntlm/_meta/fields.yml b/x-pack/filebeat/module/zeek/ntlm/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: ntlm
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek NTLM log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/ocsp/_meta/fields.yml b/x-pack/filebeat/module/zeek/ocsp/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: ocsp
   type: group
+  default_field: false
   description: |
     Fields exported by the Zeek OCSP log
     Online Certificate Status Protocol (OCSP). Only created if policy script is loaded.

diff --git a/x-pack/filebeat/module/zeek/pe/_meta/fields.yml b/x-pack/filebeat/module/zeek/pe/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: pe
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek pe log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/radius/_meta/fields.yml b/x-pack/filebeat/module/zeek/radius/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: radius
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek Radius log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/rdp/_meta/fields.yml b/x-pack/filebeat/module/zeek/rdp/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: rdp
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek RDP log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/rfb/_meta/fields.yml b/x-pack/filebeat/module/zeek/rfb/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: rfb
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek RFB log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/sip/_meta/fields.yml b/x-pack/filebeat/module/zeek/sip/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: sip
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SIP log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/smb_cmd/_meta/fields.yml b/x-pack/filebeat/module/zeek/smb_cmd/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: smb_cmd
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek smb_cmd log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/smb_files/_meta/fields.yml b/x-pack/filebeat/module/zeek/smb_files/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: smb_files
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SMB Files log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/smb_mapping/_meta/fields.yml b/x-pack/filebeat/module/zeek/smb_mapping/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: smb_mapping
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SMB_Mapping log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/smtp/_meta/fields.yml b/x-pack/filebeat/module/zeek/smtp/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: smtp
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SMTP log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/snmp/_meta/fields.yml b/x-pack/filebeat/module/zeek/snmp/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: snmp
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SNMP log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/socks/_meta/fields.yml b/x-pack/filebeat/module/zeek/socks/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: socks
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SOCKS log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/ssh/_meta/fields.yml b/x-pack/filebeat/module/zeek/ssh/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: ssh
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SSH log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/ssl/_meta/fields.yml b/x-pack/filebeat/module/zeek/ssl/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: ssl
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SSL log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/stats/_meta/fields.yml b/x-pack/filebeat/module/zeek/stats/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: stats
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek stats log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/syslog/_meta/fields.yml b/x-pack/filebeat/module/zeek/syslog/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: syslog
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek syslog log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/tunnel/_meta/fields.yml b/x-pack/filebeat/module/zeek/tunnel/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: tunnel
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek SSH log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/weird/_meta/fields.yml b/x-pack/filebeat/module/zeek/weird/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: weird
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek Weird log.
   fields:

diff --git a/x-pack/filebeat/module/zeek/x509/_meta/fields.yml b/x-pack/filebeat/module/zeek/x509/_meta/fields.yml
@@ -1,5 +1,6 @@
 - name: x509
   type: group
+  default_field: false
   description: >
     Fields exported by the Zeek x509 log.
   fields: