cisco_aironet: add ECS mapping for event.severity

[zmoog]

Proposed commit message

Add ECS mapping for the event.severity field.

If a field has a string value, Elasticsearch maps it as a keyword. This happens even on stack versions 8.13+ because ecs@mappings does not perform type coercion.

According to the sample_event.json file, the event.severity field has a string value, so Elasticsearch maps it as a keyword instead of a long:

    "event": {
        "action": "ENTRY_DELETED",
        "agent_id_status": "verified",
        "dataset": "cisco_aironet.log",
        "ingested": "2023-09-25T17:34:47Z",
        "original": "<134>WLC001: *SISF BT Process: Aug 20 11:25:50.157: %SISF-6-ENTRY_DELETED: sisf_shim_utils.c:482 Entry deleted A=fe80::aee2:d3ff:feba:56a4 V=0 I=wired:1 P=0000 M=",
        "provider": "SISF",
        "severity": "6",
        "timezone": "+00:00"
    }

By adding the event.severity field to the file fields/ecs.yml we ensure it has the expected ECS mapping.

IMPORTANT: To fully resolve the issue, the input/integration owner should update it so that they can use the expected value to leverage ecs@mappings.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Relates Verify mapping problems after migrating to ecs@mappings #10848

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[taylor-swanson]

The pipeline test is failing because it is expecting event.severity to be a long but is currently a string. We could either add a type annotation to the grok or add a convert processor. I don't have strong opinions either way.

  - grok:
      field: _temp_.full_message
      ignore_failure: true
      patterns:
        - "%{DATA:event.provider}-%{INT:event.severity:long}-%{DATA:event.action}: %{DATA}:%{INT} %{GREEDYDATA:message}"
        - "%{DATA:event.provider}-%{INT:event.severity:long}-%{DATA:event.action}: %{GREEDYDATA:message}"

Once that change is made, sample_event and readme also have to be regenerated.

[botelastic]

Hi! We just realized that we haven't looked into this PR in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 0666ac8

History

• 💔 Build #17876 failed 1790b8e
• 💔 Build #15985 failed 8b89ab0
• 💔 Build #15820 failed 607fc48
• 💔 Build #15802 failed 810beba

cc @zmoog

[andrewkroh]

@taylor-swanson Can you please take another look. I addressed your comment in b0f92da.