Cherry-pick: elastic#10030 and elastic#9869 to 6.5: Handle IPv6 zone …

…id in IIS filebeat ingest pipeline (elastic#10057) IIS logs can include zone ids when using IPv6, this is correctly parsed but geoip processor doesn't accept these addresses. Create a temporary field without the zone id to be used by geoip processor. (cherry picked from commit dad84e9) (cherry picked from commit 5f1f6ca) (cherry picked from commit e05f967) Co-authored-by: Mathieu Martin <[email protected]>
leweafan · Jan 21, 2019 · 6a907e1 · 6a907e1
1 parent 6965f91
commit 6a907e1
Show file tree

Hide file tree

Showing 7 changed files with 98 additions and 2 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -40,11 +40,14 @@ https://github.com/elastic/beats/compare/v6.5.4...6.5[Check the HEAD diff]
 
 *Filebeat*
 
+- Support IPv6 addresses with zone id in IIS ingest pipeline. {issue}9836[9836] error log: {pull}9869[9869] access log: {pull}10030[10030]
+
 *Heartbeat*
 
 *Journalbeat*
 
 *Metricbeat*
+
 - Fix panics in vsphere module when certain values where not returned by the API. {pull}9784[9784]
 
 *Packetbeat*

diff --git a/filebeat/module/iis/access/ingest/default.json b/filebeat/module/iis/access/ingest/default.json
@@ -40,10 +40,24 @@
       "target_field": "iis.access.user_agent.original"
     }
   }, {
-    "geoip": {
+   "grok": {
       "field": "iis.access.remote_ip",
+      "patterns": [
+        "%{NOZONEIP:iis.access.remote_ip_geoip}"
+      ],
+      "pattern_definitions": {
+         "NOZONEIP": "[^%]*"
+      }
+    }
+  }, {
+    "geoip": {
+      "field": "iis.access.remote_ip_geoip",
       "target_field": "iis.access.geoip"
     }
+  }, {
+    "remove": {
+      "field": "iis.access.remote_ip_geoip"
+    }
   }],
   "on_failure" : [{
     "set" : {

diff --git a/filebeat/module/iis/access/test/test-ipv6zone.log b/filebeat/module/iis/access/test/test-ipv6zone.log
@@ -0,0 +1,5 @@
+#Software: Microsoft Internet Information Services 10.0
+#Version: 1.0
+#Date: 2018-01-01 10:11:12
+#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
+2018-01-01 10:11:12 W3SVC1 MACHINE-NAME ::1%0 GET / - 80 - ::1%0 HTTP/1.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_0)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/70.0.3538.102+Safari/537.36 - - example.com 200 0 0 123 456 789
diff --git a/filebeat/module/iis/access/test/test-ipv6zone.log-expected.json b/filebeat/module/iis/access/test/test-ipv6zone.log-expected.json
@@ -0,0 +1,39 @@
+[
+    {
+        "@timestamp": "2018-01-01T10:11:12.000Z", 
+        "fileset.module": "iis", 
+        "fileset.name": "access", 
+        "iis.access.body_received.bytes": "456", 
+        "iis.access.body_sent.bytes": "123", 
+        "iis.access.cookie": "-", 
+        "iis.access.hostname": "example.com", 
+        "iis.access.http_version": "1.1", 
+        "iis.access.method": "GET", 
+        "iis.access.port": "80", 
+        "iis.access.query_string": "-", 
+        "iis.access.referrer": "-", 
+        "iis.access.remote_ip": "::1%0", 
+        "iis.access.request_time_ms": "789", 
+        "iis.access.response_code": "200", 
+        "iis.access.server_ip": "::1%0", 
+        "iis.access.server_name": "MACHINE-NAME", 
+        "iis.access.site_name": "W3SVC1", 
+        "iis.access.sub_status": "0", 
+        "iis.access.url": "/", 
+        "iis.access.user_agent.device": "Other", 
+        "iis.access.user_agent.major": "70", 
+        "iis.access.user_agent.minor": "0", 
+        "iis.access.user_agent.name": "Chrome", 
+        "iis.access.user_agent.original": "Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_0)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/70.0.3538.102+Safari/537.36", 
+        "iis.access.user_agent.os": "Mac OS X 10.14.0", 
+        "iis.access.user_agent.os_major": "10", 
+        "iis.access.user_agent.os_minor": "14", 
+        "iis.access.user_agent.os_name": "Mac OS X", 
+        "iis.access.user_agent.patch": "3538", 
+        "iis.access.user_name": "-", 
+        "iis.access.win32_status": "0", 
+        "input.type": "log", 
+        "offset": 331, 
+        "prospector.type": "log"
+    }
+]
diff --git a/filebeat/module/iis/error/ingest/default.json b/filebeat/module/iis/error/ingest/default.json
@@ -28,10 +28,24 @@
       "field": "iis.error.time"
     }
   }, {
-    "geoip": {
+    "grok": {
       "field": "iis.error.remote_ip",
+      "patterns": [
+        "%{NOZONEIP:iis.error.remote_ip_geoip}"
+      ],
+      "pattern_definitions": {
+         "NOZONEIP": "[^%]*"
+      }
+    }
+  }, {
+    "geoip": {
+      "field": "iis.error.remote_ip_geoip",
       "target_field": "iis.error.geoip"
     }
+  }, {
+    "remove": {
+      "field": "iis.error.remote_ip_geoip"
+    }
   }],
   "on_failure" : [{
     "set" : {

diff --git a/filebeat/module/iis/error/test/ipv6_zone_id.log b/filebeat/module/iis/error/test/ipv6_zone_id.log
@@ -0,0 +1,5 @@
+#Software: Microsoft HTTP API 2.0
+#Version: 1.0
+#Date: 2018-12-30 13:48:36
+#Fields: date time c-ip c-port s-ip s-port cs-version cs-method cs-uri streamid sc-status s-siteid s-reason s-queuename
+2018-12-30 14:22:07 ::1%0 49958 ::1%0 80 - - - - - - Timer_ConnectionIdle -
diff --git a/filebeat/module/iis/error/test/ipv6_zone_id.log-expected.json b/filebeat/module/iis/error/test/ipv6_zone_id.log-expected.json
@@ -0,0 +1,16 @@
+[
+    {
+        "@timestamp": "2018-12-30T14:22:07.000Z", 
+        "fileset.module": "iis", 
+        "fileset.name": "error", 
+        "iis.error.queue_name": "-", 
+        "iis.error.reason_phrase": "Timer_ConnectionIdle", 
+        "iis.error.remote_ip": "::1%0", 
+        "iis.error.remote_port": "49958", 
+        "iis.error.server_ip": "::1%0", 
+        "iis.error.server_port": "80", 
+        "input.type": "log", 
+        "offset": 195, 
+        "prospector.type": "log"
+    }
+]