Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] MSSQL module #12079

Merged
merged 9 commits into from
May 30, 2019
Merged

[Filebeat] MSSQL module #12079

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
0c92513
Atomic commit
sayden May 7, 2019
19feb2e
mage fmt update and make update
sayden May 7, 2019
b9baac7
Add convert_timezone and reorder a couple of fields
sayden May 8, 2019
99e224d
...
sayden May 15, 2019
380c3f1
Remove not needed step in the processor
sayden May 16, 2019
c7d3da2
Rename field and remove not used one
sayden May 27, 2019
3098f43
Update OSS fields.asciidoc
sayden May 28, 2019
7d76d6e
Update type of origin field
sayden May 28, 2019
dca6e89
Add new step in the pipeline
sayden May 30, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Rename field and remove not used one
  • Loading branch information
@sayden
sayden committed May 28, 2019
commit c7d3da202c7b768e96c3a918396259f3771713ce
2 changes: 1 addition & 1 deletion x-pack/filebeat/module/mssql/fields.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 1 addition & 4 deletions x-pack/filebeat/module/mssql/log/_meta/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,6 @@
description: Common log fields
type: group
fields:
- name: source
- name: origin
description: Origin of the message, usually the server but it can also be a recovery process
type: text
- name: msg
description: Text of the message
type: text
2 changes: 1 addition & 1 deletion x-pack/filebeat/module/mssql/log/ingest/pipeline.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
{
"grok": {
"field": "message",
"patterns": ["%{MSSQL_DATE:date} %{DATA:mssql.log.source} [ ]*%{GREEDYDATA:msg_temp}"],
"patterns": ["%{MSSQL_DATE:date} %{DATA:mssql.log.origin} [ ]*%{GREEDYDATA:msg_temp}"],
"pattern_definitions": {
"MSSQL_DATE":"%{DATA} %{DATA}"
}
Expand Down
30 changes: 15 additions & 15 deletions x-pack/filebeat/module/mssql/log/test/test.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"log.offset": 0,
"log.original": "2019-05-03 09:01:09.99 Server Microsoft SQL Server 2017 (RTM-CU13) (KB4466404) - 14.0.3048.4 (X64)\n\tNov 30 2018 12:57:58\n\tCopyright (C) 2017 Microsoft Corporation\n\tDeveloper Edition (64-bit) on Linux (Ubuntu 16.04.5 LTS)",
"message": "Microsoft SQL Server 2017 (RTM-CU13) (KB4466404) - 14.0.3048.4 (X64)",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -27,7 +27,7 @@
"log.offset": 226,
"log.original": "2019-05-03 09:01:09.99 Server UTC adjustment: 0:00",
"message": "UTC adjustment: 0:00",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -41,7 +41,7 @@
"log.offset": 282,
"log.original": "2019-05-03 09:01:09.99 Server (c) Microsoft Corporation.",
"message": "(c) Microsoft Corporation.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -55,7 +55,7 @@
"log.offset": 344,
"log.original": "2019-05-03 09:01:09.99 Server All rights reserved.",
"message": "All rights reserved.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -69,7 +69,7 @@
"log.offset": 400,
"log.original": "2019-05-03 09:01:10.00 Server Server process ID is 4124.",
"message": "Server process ID is 4124.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -83,7 +83,7 @@
"log.offset": 462,
"log.original": "2019-05-03 09:01:10.00 Server Logging SQL Server messages in file '/var/opt/mssql/log/errorlog'.",
"message": "Logging SQL Server messages in file '/var/opt/mssql/log/errorlog'.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -100,7 +100,7 @@
"log.offset": 564,
"log.original": "2019-05-03 09:01:10.00 Server Registry startup parameters:\n\t -d /var/opt/mssql/data/master.mdf\n\t -l /var/opt/mssql/data/mastlog.ldf\n\t -e /var/opt/mssql/log/errorlog",
"message": "Registry startup parameters:",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -114,7 +114,7 @@
"log.offset": 734,
"log.original": "2019-05-03 09:01:10.00 Server SQL Server detected 1 sockets with 6 cores per socket and 12 logical processors per socket, 12 total logical processors; using 12 logical processors based on SQL Server licensing. This is an informational message; no user action is required.",
"message": "SQL Server detected 1 sockets with 6 cores per socket and 12 logical processors per socket, 12 total logical processors; using 12 logical processors based on SQL Server licensing. This is an informational message; no user action is required.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -128,7 +128,7 @@
"log.offset": 1011,
"log.original": "2019-05-03 09:01:10.00 Server SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.",
"message": "SQL Server is starting at normal priority base (=7). This is an informational message only. No user action is required.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -142,7 +142,7 @@
"log.offset": 1166,
"log.original": "2019-05-03 09:01:10.00 Server Detected 25445 MB of RAM. This is an informational message; no user action is required.",
"message": "Detected 25445 MB of RAM. This is an informational message; no user action is required.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -156,7 +156,7 @@
"log.offset": 1289,
"log.original": "2019-05-03 09:01:10.00 Server Using conventional memory in the memory manager.",
"message": "Using conventional memory in the memory manager.",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -170,7 +170,7 @@
"log.offset": 1373,
"log.original": "2019-05-03 09:01:10.01 Server Large Page Allocated: 32MB",
"message": "Large Page Allocated: 32MB",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -184,7 +184,7 @@
"log.offset": 1435,
"log.original": "2019-05-03 09:01:10.20 Server Buffer pool extension is already disabled. No action is n",
"message": "Buffer pool extension is already disabled. No action is n",
"mssql.log.source": "Server",
"mssql.log.origin": "Server",
"service.type": "mssql"
},
{
Expand All @@ -198,7 +198,7 @@
"log.offset": 1528,
"log.original": "2019-05-03 09:01:11.93 spid22s Service Broker manager has started.",
"message": "Service Broker manager has started.",
"mssql.log.source": "spid22s",
"mssql.log.origin": "spid22s",
"service.type": "mssql"
},
{
Expand All @@ -212,7 +212,7 @@
"log.offset": 1599,
"log.original": "2019-05-03 09:01:12.03 spid6s Recovery is complete. This is an informational message only. No user action is required.",
"message": "Recovery is complete. This is an informational message only. No user action is required.",
"mssql.log.source": "spid6s",
"mssql.log.origin": "spid6s",
"service.type": "mssql"
}
]