fix(fim/ebpf): make container id event field ecs-compliant

elastic · Apr 5, 2024 · 6b0bae8 · 6b0bae8
1 parent 823694b
commit 6b0bae8
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/auditbeat/module/file_integrity/event.go b/auditbeat/module/file_integrity/event.go
@@ -402,7 +402,7 @@ func buildMetricbeatEvent(e *Event, existedBefore bool) mb.Event {
 	}
 
 	if e.ContainerID != "" {
-		file["container.id"] = e.ContainerID
+		out.MetricSetFields.Put("container.id", e.ContainerID)
 	}
 
 	if len(e.Hashes) > 0 {

diff --git a/auditbeat/module/file_integrity/event_linux.go b/auditbeat/module/file_integrity/event_linux.go
@@ -44,11 +44,11 @@ func NewEventFromEbpfEvent(
 ) (Event, bool) {
 	var (
 		path, target, cgroupPath string
-		action       Action
-		metadata     Metadata
-		process      Process
-		err          error
-		errors       = make([]error, 0)
+		action                   Action
+		metadata                 Metadata
+		process                  Process
+		err                      error
+		errors                   []error
 	)
 	switch ee.Type {
 	case ebpfevents.EventTypeFileCreate: