Spelling

auditbeat/module/file_integrity/eventreader_test.go

@@ -41,7 +41,7 @@ func init() {
 const ErrorSharingViolation syscall.Errno = 32
 
 func TestEventReader(t *testing.T) {
-	t.Skip("Flaky test: about 1/10 of bulds fails https://github.com/elastic/beats/issues/21302")
+	t.Skip("Flaky test: about 1/10 of builds fails https://github.com/elastic/beats/issues/21302")
 	// Make dir to monitor.
 	dir, err := ioutil.TempDir("", "audit")
 	if err != nil {
@@ -241,7 +241,7 @@ func TestEventReader(t *testing.T) {
 }
 
 func TestRaces(t *testing.T) {
-	t.Skip("Flaky test: about 1/20 of bulds fails https://github.com/elastic/beats/issues/21303")
+	t.Skip("Flaky test: about 1/20 of builds fails https://github.com/elastic/beats/issues/21303")
 	const (
 		fileMode os.FileMode = 0640
 		N                    = 100

auditbeat/module/file_integrity/fileinfo_windows.go

@@ -93,7 +93,7 @@ func fileOwner(path string) (sid, owner string, err error) {
 	}
 	defer syscall.LocalFree((syscall.Handle)(unsafe.Pointer(securityDescriptor)))
 
-	// Covert SID to a string and lookup the username.
+	// Convert SID to a string and lookup the username.
 	var errs multierror.Errors
 	sid, err = securityID.String()
 	if err != nil {

dev-tools/ecs-migration.yml

@@ -54,7 +54,7 @@
   alias6: true
   alias: true
 
-- from: docker.container.labels # TODO: How to map these?
+- from: docker.container.labels  # TODO: How to map these?
   to: container.labels
   alias6: false
   alias: true
@@ -115,8 +115,8 @@
 
 - from: source
   to:
-    - log.file.path
-    - log.source.address
+  - log.file.path
+  - log.source.address
   alias: false
   beat: filebeat
 
@@ -428,7 +428,7 @@
   beat: filebeat
 
 - from: suricata.eve.timestamp
-  to: "@timestamp"
+  to: '@timestamp'
   alias: true
   beat: filebeat
 
@@ -476,7 +476,7 @@
   beat: filebeat
 
 - from: system.auth.timestamp
-  to: "@timestamp"
+  to: '@timestamp'
   alias: true
   beat: filebeat
 
@@ -560,6 +560,155 @@
   alias: true
   beat: filebeat
 
+## Apache module
+
+- from: apache2.access.remote_ip
+  to: source.address
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.user_name
+  to: user.name
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.method
+  to: http.request.method
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.url
+  to: url.original
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.http_version
+  to: http.version
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.response_code
+  to: http.response.status_code
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.referrer
+  to: http.request.referrer
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.agent
+  to: user_agent.original
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.body_sent.bytes
+  to: http.response.body.bytes
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.geoip.continent_name
+  to: source.geo.continent_name
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.geoip.country_iso_code
+  to: source.geo.country_iso_code
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.geoip.location
+  to: source.geo.location
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.geoip.region_name
+  to: source.geo.region_name
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.geoip.city_name
+  to: source.geo.city_name
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.geoip.region_iso_code
+  to: source.geo.region_iso_code
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.user_agent.original
+  to: user_agent.original
+  alias: true
+  beat: filebeat
+- from: apache2.access.user_agent.device
+  to: user_agent.device.name
+  alias: true
+  beat: filebeat
+- from: apache2.access.user_agent.name
+  to: user_agent.name
+  alias: true
+  beat: filebeat
+- from: apache2.access.user_agent.os
+  to: user_agent.os.full_name
+  alias: true
+  beat: filebeat
+- from: apache2.access.user_agent.os_name
+  to: user_agent.os.name
+  alias: true
+  beat: filebeat
+
+- from: apache2.access.user_agent.major
+  to: user_agent.version
+  alias: false
+  beat: filebeat
+- from: apache2.access.user_agent.minor
+  to: user_agent.version
+  alias: false
+  beat: filebeat
+- from: apache2.access.user_agent.patch
+  to: user_agent.version
+  alias: false
+  beat: filebeat
+- from: apache2.access.user_agent.os_major
+  to: user_agent.os.version
+  alias: false
+  beat: filebeat
+- from: apache2.access.user_agent.os_minor
+  to: user_agent.os.version
+  alias: false
+  beat: filebeat
+- from: apache2.access.user_agent.os_patch
+  to: user_agent.os.version
+  alias: false
+  beat: filebeat
+
+### Error fileset
+- from: apache2.error.message
+  to: message
+  alias: true
+  beat: filebeat
+
+- from: apache2.error.level
+  to: log.level
+  alias: true
+  beat: filebeat
+
+- from: apache2.error.client
+  to: source.address
+  alias: true
+  beat: filebeat
+
+- from: apache2.error.pid
+  to: process.pid
+  alias: true
+  beat: filebeat
+
+- from: apache2.error.tid
+  to: process.thread.id
+  alias: true
+  beat: filebeat
+
 ## Elasticsearch module
 
 - from: elasticsearch.audit.origin_address
@@ -1599,6 +1748,7 @@
   alias: true
   beat: metricbeat
 
+
 ### Redis
 
 - from: php_fpm.status.pid
@@ -1872,7 +2022,7 @@
 - from: method
   to: http.request.method
   alias: false
-  comment: Field is used by serveral protocols.
+  comment: Field is used by several protocols.
   beat: packetbeat
 
 - from: path
@@ -1883,15 +2033,15 @@
 - from: real_ip
   to: network.forwarded_ip
   alias: false
-  comment: Field is used by serveral protocols.
+  comment: Field is used by several protocols.
   beat: packetbeat
 
 ## MySQL
 - from: mysql.iserror
   to: status
   alias: false
   comment: >
-    Status reflects whether or not an error occured. Its values are either
+    Status reflects whether or not an error occurred. Its values are either
     OK or Error.
   beat: packetbeat
 

dev-tools/jenkins_release.sh

@@ -45,7 +45,7 @@ cleanup() {
 trap cleanup EXIT
 
 # This controls the defaults used the Jenkins package job. They can be
-# overridden by setting them in the environement prior to running this script.
+# overridden by setting them in the environment prior to running this script.
 export SNAPSHOT="${SNAPSHOT:-true}"
 export PLATFORMS="${PLATFORMS:-+linux/armv7 +linux/ppc64le +linux/s390x +linux/mips64}"
 

dev-tools/mage/gotest_test.go

@@ -139,7 +139,7 @@ func TestGoTest_CaptureOutput(t *testing.T) {
 
 			output := buf.String()
 			if !re.MatchString(output) {
-				t.Fatalf("GoTest output missmatch:\nwant:\n%v\n\ngot:\n%v", test.want, output)
+				t.Fatalf("GoTest output mismatch:\nwant:\n%v\n\ngot:\n%v", test.want, output)
 			}
 		})
 	}

dev-tools/mage/integtest.go

@@ -135,7 +135,7 @@ type IntegrationTester interface {
 	Use(dir string) (bool, error)
 	// HasRequirements returns an error if requirements are missing.
 	HasRequirements() error
-	// Test performs excecuting the test inside the environment.
+	// Test performs executing the test inside the environment.
 	Test(dir string, mageTarget string, env map[string]string) error
 	// InsideTest performs the actual test on the inside of environment.
 	InsideTest(test func() error) error

dev-tools/mage/kubernetes/kubectl.go

@@ -28,7 +28,7 @@ import (
 	"github.com/magefile/mage/sh"
 )
 
-// KubectlApply applys the manifest file to the kubernetes cluster.
+// KubectlApply applies the manifest file to the kubernetes cluster.
 //
 // KUBECONFIG must be in `env` to target a specific cluster.
 func KubectlApply(env map[string]string, stdout, stderr io.Writer, filepath string) error {
@@ -60,7 +60,7 @@ func KubectlDelete(env map[string]string, stdout, stderr io.Writer, filepath str
 	return err
 }
 
-// KubectlApplyInput applys the manifest string to the kubernetes cluster.
+// KubectlApplyInput applies the manifest string to the kubernetes cluster.
 //
 // KUBECONFIG must be in `env` to target a specific cluster.
 func KubectlApplyInput(env map[string]string, stdout, stderr io.Writer, manifest string) error {