[filebeat][google workspace] - Added canonical sorting over fingerpri…

…nt keys array to maintain key order (#40055) * added canonical sorting over fingerprint keys array to maintain key order
elastic · Jul 2, 2024 · 76a62eb · 76a62eb
1 parent 53bf67c
commit 76a62eb
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -146,6 +146,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix request trace filename handling in http_endpoint input. {pull}39410[39410]
 - Fix filestream not correctly tracking the offset of a file when using the `include_message` parser. {pull}39873[39873] {issue}39653[39653]
 - Upgrade github.com/hashicorp/go-retryablehttp to mitigate CVE-2024-6104 {pull}40036[40036]
+- Fix for Google Workspace duplicate events issue by adding canonical sorting over fingerprint keys array to maintain key order. {pull}40055[40055] {issue}39859[39859]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/google_workspace/config/common.js b/x-pack/filebeat/module/google_workspace/config/common.js
@@ -25,15 +25,16 @@ var googleWorkspace = (function () {
             "json.id.applicationName",
             "json.id.customerId",
         ];
+        var dynKeyArr = [];
         Object.keys(evt.Get("json.events")).forEach(function(evtsKey) {
             var key = "json.events."+evtsKey;
             var value = evt.Get(key);
             if (!Array.isArray(value) && !(typeof value === "object")) {
-                keys.push(key);
+                dynKeyArr.push(key);
             }
         });
         new processor.Fingerprint({
-            fields: keys,
+            fields: keys.concat(dynKeyArr.sort()),
             target_field: "@metadata._id",
             ignore_missing: true,
             fail_on_error: false,