Skip to content

Commit

Permalink
[Logs UI] Fix some filebeat ECS message formats (elastic#31120)
Browse files Browse the repository at this point in the history
  • Loading branch information
weltenwort committed Feb 21, 2019
1 parent 5556a6e commit e828526
Show file tree
Hide file tree
Showing 21 changed files with 1,890 additions and 355 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@
* you may not use this file except in compliance with the Elastic License.
*/

import { builtinRules } from '.';
import { compileFormattingRules } from '../message';
import { filebeatApache2Rules } from './filebeat_apache2';

const { format } = compileFormattingRules(filebeatApache2Rules);
const { format } = compileFormattingRules(builtinRules);

describe('Filebeat Rules', () => {
describe('in ECS format', () => {
Expand Down Expand Up @@ -45,7 +45,15 @@ describe('Filebeat Rules', () => {
expect(format(flattenedDocument)).toMatchInlineSnapshot(`
Array [
Object {
"constant": "[Apache][access] ",
"constant": "[",
},
Object {
"field": "event.module",
"highlights": Array [],
"value": "apache",
},
Object {
"constant": "][access] ",
},
Object {
"field": "source.ip",
Expand Down Expand Up @@ -123,7 +131,7 @@ Array [
expect(format(flattenedDocument)).toMatchInlineSnapshot(`
Array [
Object {
"constant": "[Apache][",
"constant": "[apache][",
},
Object {
"field": "log.level",
Expand Down Expand Up @@ -159,7 +167,7 @@ Array [
expect(format(flattenedDocument)).toMatchInlineSnapshot(`
Array [
Object {
"constant": "[Apache][access] ",
"constant": "[apache][access] ",
},
Object {
"field": "apache2.access.remote_ip",
Expand Down Expand Up @@ -228,7 +236,7 @@ Array [
expect(format(flattenedDocument)).toMatchInlineSnapshot(`
Array [
Object {
"constant": "[Apache][",
"constant": "[apache][",
},
Object {
"field": "apache2.error.level",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -5,66 +5,14 @@
*/

export const filebeatApache2Rules = [
{
// ECS
when: {
values: {
'event.dataset': 'apache.access',
},
},
format: [
{
constant: '[Apache][access] ',
},
{
field: 'source.ip',
},
{
constant: ' ',
},
{
field: 'user.name',
},
{
constant: ' "',
},
{
field: 'http.request.method',
},
{
constant: ' ',
},
{
field: 'url.original',
},
{
constant: ' HTTP/',
},
{
field: 'http.version',
},
{
constant: '" ',
},
{
field: 'http.response.status_code',
},
{
constant: ' ',
},
{
field: 'http.response.body.bytes',
},
],
},
{
// pre-ECS
when: {
exists: ['apache2.access'],
},
format: [
{
constant: '[Apache][access] ',
constant: '[apache][access] ',
},
{
field: 'apache2.access.remote_ip',
Expand Down Expand Up @@ -116,7 +64,7 @@ export const filebeatApache2Rules = [
},
format: [
{
constant: '[Apache][',
constant: '[apache][',
},
{
field: 'log.level',
Expand All @@ -136,7 +84,7 @@ export const filebeatApache2Rules = [
},
format: [
{
constant: '[Apache][',
constant: '[apache][',
},
{
field: 'apache2.error.level',
Expand Down
Loading

0 comments on commit e828526

Please sign in to comment.