Remove document_id and make docs more clear

marc-gr · marc-gr · commit cfcb4f11ed8d · 2021-04-20T09:25:32.000+02:00
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -616,7 +616,6 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Libbeat: report queue capacity, output batch size, and output client count to monitoring. {pull}24700[24700]
 - Add kubernetes.pod.ip field in kubernetes metadata. {pull}25037[25037]
 - Discover changes in Kubernetes namespace metadata as soon as they happen. {pull}25117[25117]
-- Add `decode_xml_wineventlog` processor. {issue}23910[23910] {pull}25109[25109]
 - Add `decode_xml_wineventlog` processor. {issue}23910[23910] {pull}25115[25115]
 
 *Auditbeat*
diff --git a/libbeat/processors/decode_xml_wineventlog/config.go b/libbeat/processors/decode_xml_wineventlog/config.go
@@ -22,7 +22,6 @@ type config struct {
 	Target        string `config:"target_field"`
 	OverwriteKeys bool   `config:"overwrite_keys"`
 	MapECSFields  bool   `config:"map_ecs_fields"`
-	DocumentID    string `config:"document_id"`
 	IgnoreMissing bool   `config:"ignore_missing"`
 	IgnoreFailure bool   `config:"ignore_failure"`
 }
diff --git a/libbeat/processors/decode_xml_wineventlog/docs/decode_xml_wineventlog.asciidoc b/libbeat/processors/decode_xml_wineventlog/docs/decode_xml_wineventlog.asciidoc
@@ -27,11 +27,7 @@ exist in the event are overwritten by keys from the decoded XML object. The
 default value is `true`.
 
 `map_ecs_fields`:: (Optional) A boolean that specifies whether to map additional ECS
-fields when possible. The default value is `true`.
-
-`document_id`:: (Optional) XML key to use as the document ID. If configured, the
-field will be removed from the original XML document and stored in
-`@metadata._id`.
+fields when possible. Note that ECS field keys are placed outside of `target_field`. The default value is `true`.
 
 `ignore_missing`:: (Optional) If `true` the processor will not return an error
 when a specified field does not exist. Defaults to `false`.
diff --git a/libbeat/processors/decode_xml_wineventlog/processor.go b/libbeat/processors/decode_xml_wineventlog/processor.go
@@ -48,9 +48,8 @@ func init() {
 			checks.RequireFields("field", "target_field"),
 			checks.AllowedFields(
 				"field", "target_field",
-				"overwrite_keys", "document_id",
+				"overwrite_keys", "map_ecs_fields",
 				"ignore_missing", "ignore_failure",
-				"map_ecs_fields",
 			)))
 	jsprocessor.RegisterPlugin(procName, New)
 }
@@ -89,7 +88,7 @@ func newProcessor(config config) (processors.Processor, error) {
 
 func (p *processor) Run(event *beat.Event) (*beat.Event, error) {
 	if err := p.run(event); err != nil && !p.IgnoreFailure {
-		err = fmt.Errorf("failed in decode_xml on the %q field: %w", p.Field, err)
+		err = fmt.Errorf("failed in decode_xml_wineventlog on the %q field: %w", p.Field, err)
 		event.PutValue("error.message", err.Error())
 		return event, err
 	}
@@ -115,14 +114,6 @@ func (p *processor) run(event *beat.Event) error {
 		return fmt.Errorf("error decoding XML field: %w", err)
 	}
 
-	var id string
-	if tmp, err := common.MapStr(win).GetValue(p.DocumentID); err == nil {
-		if v, ok := tmp.(string); ok {
-			id = v
-			common.MapStr(win).Delete(p.DocumentID)
-		}
-	}
-
 	if p.Target != "" {
 		if _, err = event.PutValue(p.Target, win); err != nil {
 			return fmt.Errorf("failed to put value %v into field %q: %w", win, p.Target, err)
@@ -135,10 +126,6 @@ func (p *processor) run(event *beat.Event) error {
 		jsontransform.WriteJSONKeys(event, ecs, false, p.OverwriteKeys, !p.IgnoreFailure)
 	}
 
-	if id != "" {
-		event.SetID(id)
-	}
-
 	return nil
 }
 

Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,6 @@ type config struct {`
`22`	`22`	Target string `config:"target_field"`
`23`	`23`	OverwriteKeys bool `config:"overwrite_keys"`
`24`	`24`	MapECSFields bool `config:"map_ecs_fields"`
`25`		- DocumentID string `config:"document_id"`
`26`	`25`	IgnoreMissing bool `config:"ignore_missing"`
`27`	`26`	IgnoreFailure bool `config:"ignore_failure"`
`28`	`27`	`}`