Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x-pack/filebeat/module/sophos/xg: fix kv field separation and add support for timestamped log line #29331

Merged
merged 6 commits into from
Jan 4, 2022

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Dec 8, 2021

What does this PR do?

This fixes KV field separation and adds support for log lines that have syslog-style timestamps and hostname headers.

Why is it important?

The current situation is breaking some users.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

How to test this PR locally

Python integration tests for x-pack filebeat,

Related issues

Use cases

N/A

Screenshots

N/A

Logs

N/A

@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Dec 8, 2021
@efd6
Copy link
Contributor Author

efd6 commented Dec 8, 2021

First commit is the interesting one, second is entirely mechanical.

@elasticmachine
Copy link
Collaborator

elasticmachine commented Dec 8, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-01-04T04:51:57.514+0000

  • Duration: 107 min 22 sec

  • Commit: 3721b6b

Test stats 🧪

Test Results
Failed 0
Passed 9638
Skipped 1275
Total 10913

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@mergify
Copy link
Contributor

mergify bot commented Dec 13, 2021

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b sophos/fw upstream/sophos/fw
git merge upstream/master
git push upstream sophos/fw

@mergify
Copy link
Contributor

mergify bot commented Dec 17, 2021

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b sophos/fw upstream/sophos/fw
git merge upstream/master
git push upstream sophos/fw

Copy link
Contributor

@adriansr adriansr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@efd6 efd6 merged commit 0ea9581 into elastic:master Jan 4, 2022
mergify bot pushed a commit that referenced this pull request Jan 4, 2022
…port for timestamped log line (#29331)

This change also needed changes in the cisco asa module's test expect files
to bring timestamp handling during testing up to date.

(cherry picked from commit 0ea9581)
efd6 added a commit that referenced this pull request Jan 4, 2022
…port for timestamped log line (#29331) (#29672)

This change also needed changes in the cisco asa module's test expect files
to bring timestamp handling during testing up to date.

(cherry picked from commit 0ea9581)

Co-authored-by: Dan Kortschak <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
8.1-candidate backport-v8.0.0 Automated backport with mergify bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Filebeat] Dissect Parsing Error with Sophos Module
3 participants