Skip to content

Commit febb559

Browse files
marc-grmergify-bot
marc-gr
authored and
mergify-bot
committed
[filebeat][fortinet] Use default add_locale for fortinet.firewall (#26524)
* Use default add_locale for fortinet.firewall * Use event.timezone in all date processors (cherry picked from commit 5d258c8)
1 parent 93af1c8 commit febb559

8 files changed

Lines changed: 109 additions & 73 deletions

File tree

‎CHANGELOG.next.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -605,6 +605,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
605605
- Add `uri_parts` and `user_agent` ingest processors to `aws.elb` module. {issue}26435[26435] {pull}26441[26441]
606606
- Added dataset `recordedfuture` to the `threatintel` module to ingest indicators from Recorded Future Connect API {pull}26481[26481]
607607
- Update `fortinet` ingest pipelines. {issue}22136[22136] {issue}25254[25254] {pull}24816[24816]
608+
- Use default add_locale for fortinet.firewall {issue}20300[20300] {pull}26524[26524]
608609

609610
*Heartbeat*
610611

‎filebeat/docs/modules/fortinet.asciidoc‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ include::../include/gs-link.asciidoc[]
2727
[float]
2828
=== Compatibility
2929

30-
This module has been tested against FortiOS version 6.0.x and 6.2.x.
30+
This module has been tested against FortiOS version 6.0.x and 6.2.x.
3131
Versions above this are expected to work but have not been tested.
3232

3333
include::../include/configuring-intro.asciidoc[]
@@ -51,6 +51,8 @@ include::../include/config-option-intro.asciidoc[]
5151

5252
include::../include/var-paths.asciidoc[]
5353

54+
include::../include/timezone-support.asciidoc[]
55+
5456
*`var.input`*::
5557

5658
The input to use, can be either the value `tcp`, `udp` or `file`.

‎x-pack/filebeat/module/fortinet/_meta/docs.asciidoc‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ include::../include/gs-link.asciidoc[]
2222
[float]
2323
=== Compatibility
2424

25-
This module has been tested against FortiOS version 6.0.x and 6.2.x.
25+
This module has been tested against FortiOS version 6.0.x and 6.2.x.
2626
Versions above this are expected to work but have not been tested.
2727

2828
include::../include/configuring-intro.asciidoc[]
@@ -46,6 +46,8 @@ include::../include/config-option-intro.asciidoc[]
4646

4747
include::../include/var-paths.asciidoc[]
4848

49+
include::../include/timezone-support.asciidoc[]
50+
4951
*`var.input`*::
5052

5153
The input to use, can be either the value `tcp`, `udp` or `file`.

‎x-pack/filebeat/module/fortinet/firewall/config/firewall.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ tags: {{.tags | tojson}}
2525
publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
2626

2727
processors:
28+
- add_locale: ~
2829
- add_fields:
2930
target: ''
3031
fields:

‎x-pack/filebeat/module/fortinet/firewall/ingest/pipeline.yml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -41,12 +41,12 @@ processors:
4141
ignore_empty_value: true
4242
- set:
4343
field: _temp.time
44-
value: "{{fortinet.firewall.date}} {{fortinet.firewall.time}} {{fortinet.firewall.tz}}"
45-
if: "ctx.fortinet?.firewall?.tz != null"
44+
value: "{{fortinet.firewall.date}} {{fortinet.firewall.time}} {{event.timezone}}"
45+
if: "ctx.event?.timezone != null"
4646
- set:
4747
field: _temp.time
4848
value: "{{fortinet.firewall.date}} {{fortinet.firewall.time}}"
49-
if: "ctx.fortinet?.firewall?.tz == null"
49+
if: "ctx.event?.timezone == null"
5050
- date:
5151
field: _temp.time
5252
target_field: "@timestamp"
@@ -55,8 +55,8 @@ processors:
5555
- yyyy-MM-dd HH:mm:ss Z
5656
- yyyy-MM-dd HH:mm:ss z
5757
- ISO8601
58-
timezone: "{{fortinet.firewall.tz}}"
59-
if: "ctx.fortinet?.firewall?.tz != null"
58+
timezone: "{{event.timezone}}"
59+
if: "ctx.event?.timezone != null"
6060
- date:
6161
field: _temp.time
6262
target_field: "@timestamp"
@@ -65,7 +65,7 @@ processors:
6565
- yyyy-MM-dd HH:mm:ss Z
6666
- yyyy-MM-dd HH:mm:ss z
6767
- ISO8601
68-
if: "ctx.fortinet?.firewall?.tz == null"
68+
if: "ctx.event?.timezone == null"
6969
- gsub:
7070
field: fortinet.firewall.eventtime
7171
pattern: "\\d{6}$"
@@ -76,27 +76,27 @@ processors:
7676
target_field: event.start
7777
formats:
7878
- UNIX_MS
79-
timezone: "{{fortinet.firewall.tz}}"
80-
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.fortinet?.firewall?.tz != null && (ctx.fortinet?.firewall?.eventtime).length() > 11"
79+
timezone: "{{event.timezone}}"
80+
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.event?.timezone != null && (ctx.fortinet?.firewall?.eventtime).length() > 11"
8181
- date:
8282
field: fortinet.firewall.eventtime
8383
target_field: event.start
8484
formats:
8585
- UNIX
86-
timezone: "{{fortinet.firewall.tz}}"
87-
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.fortinet?.firewall?.tz != null && (ctx.fortinet?.firewall?.eventtime).length() <= 11"
86+
timezone: "{{event.timezone}}"
87+
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.event?.timezone != null && (ctx.fortinet?.firewall?.eventtime).length() <= 11"
8888
- date:
8989
field: fortinet.firewall.eventtime
9090
target_field: event.start
9191
formats:
9292
- UNIX_MS
93-
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.fortinet?.firewall?.tz == null && (ctx.fortinet?.firewall?.eventtime).length() > 11"
93+
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.event?.timezone == null && (ctx.fortinet?.firewall?.eventtime).length() > 11"
9494
- date:
9595
field: fortinet.firewall.eventtime
9696
target_field: event.start
9797
formats:
9898
- UNIX
99-
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.fortinet?.firewall?.tz == null && (ctx.fortinet?.firewall?.eventtime).length() <= 11"
99+
if: "ctx?.fortinet?.firewall?.eventtime != null && ctx.event?.timezone == null && (ctx.fortinet?.firewall?.eventtime).length() <= 11"
100100
- script:
101101
lang: painless
102102
source: "ctx.event.duration = Long.parseLong(ctx.fortinet.firewall.duration) * 1000000000"

‎x-pack/filebeat/module/fortinet/firewall/test/event.log-expected.json‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -635,7 +635,7 @@
635635
]
636636
},
637637
{
638-
"@timestamp": "2020-11-02T08:11:38.000Z",
638+
"@timestamp": "2020-11-02T08:11:38.000-02:00",
639639
"destination.as.number": 15169,
640640
"destination.as.organization.name": "Google LLC",
641641
"destination.geo.continent_name": "North America",
@@ -654,6 +654,7 @@
654654
"event.kind": "event",
655655
"event.module": "fortinet",
656656
"event.outcome": "success",
657+
"event.timezone": "-02:00",
657658
"event.type": [
658659
"connection"
659660
],
@@ -696,15 +697,16 @@
696697
]
697698
},
698699
{
699-
"@timestamp": "2019-05-13T11:20:54.000Z",
700+
"@timestamp": "2019-05-13T11:20:54.000-02:00",
700701
"destination.ip": "172.16.200.2",
701702
"event.action": "login",
702703
"event.code": "0100032001",
703704
"event.dataset": "fortinet.firewall",
704705
"event.kind": "event",
705706
"event.module": "fortinet",
706707
"event.reason": "none",
707-
"event.start": "2019-05-13T18:20:54.587Z",
708+
"event.start": "2019-05-13T16:20:54.587-02:00",
709+
"event.timezone": "-02:00",
708710
"fileset.name": "firewall",
709711
"fortinet.firewall.action": "login",
710712
"fortinet.firewall.method": "ssh",
@@ -740,7 +742,7 @@
740742
]
741743
},
742744
{
743-
"@timestamp": "2019-05-13T14:21:42.000Z",
745+
"@timestamp": "2019-05-13T14:21:42.000-02:00",
744746
"destination.as.number": 7065,
745747
"destination.as.organization.name": "Sonoma Interconnect",
746748
"destination.geo.city_name": "North Highlands",
@@ -762,7 +764,8 @@
762764
"event.kind": "event",
763765
"event.module": "fortinet",
764766
"event.outcome": "success",
765-
"event.start": "2019-05-13T21:21:42.722Z",
767+
"event.start": "2019-05-13T19:21:42.722-02:00",
768+
"event.timezone": "-02:00",
766769
"event.type": [
767770
"connection"
768771
],
@@ -813,7 +816,7 @@
813816
]
814817
},
815818
{
816-
"@timestamp": "2019-05-13T15:55:56.000Z",
819+
"@timestamp": "2019-05-13T15:55:56.000-02:00",
817820
"destination.ip": "172.16.200.55",
818821
"event.action": "authentication",
819822
"event.category": [
@@ -823,7 +826,8 @@
823826
"event.dataset": "fortinet.firewall",
824827
"event.kind": "event",
825828
"event.module": "fortinet",
826-
"event.start": "2019-05-13T22:55:56.913Z",
829+
"event.start": "2019-05-13T20:55:56.913-02:00",
830+
"event.timezone": "-02:00",
827831
"fileset.name": "firewall",
828832
"fortinet.firewall.action": "authentication",
829833
"fortinet.firewall.authproto": "TELNET(10.1.100.11)",
@@ -859,13 +863,14 @@
859863
]
860864
},
861865
{
862-
"@timestamp": "2019-05-14T08:32:13.000Z",
866+
"@timestamp": "2019-05-14T08:32:13.000-02:00",
863867
"event.action": "add",
864868
"event.code": "0107045057",
865869
"event.dataset": "fortinet.firewall",
866870
"event.kind": "event",
867871
"event.module": "fortinet",
868-
"event.start": "2019-05-14T15:32:13.900Z",
872+
"event.start": "2019-05-14T13:32:13.900-02:00",
873+
"event.timezone": "-02:00",
869874
"fileset.name": "firewall",
870875
"fortinet.firewall.action": "add",
871876
"fortinet.firewall.connection_type": "sslvpn",
@@ -898,13 +903,14 @@
898903
]
899904
},
900905
{
901-
"@timestamp": "2019-05-14T08:19:38.000Z",
906+
"@timestamp": "2019-05-14T08:19:38.000-02:00",
902907
"event.action": "close",
903908
"event.code": "0107045058",
904909
"event.dataset": "fortinet.firewall",
905910
"event.kind": "event",
906911
"event.module": "fortinet",
907-
"event.start": "2019-05-14T15:19:39.037Z",
912+
"event.start": "2019-05-14T13:19:39.037-02:00",
913+
"event.timezone": "-02:00",
908914
"fileset.name": "firewall",
909915
"fortinet.firewall.action": "close",
910916
"fortinet.firewall.connection_type": "sslvpn",

‎x-pack/filebeat/module/fortinet/firewall/test/traffic.log-expected.json‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[
22
{
3-
"@timestamp": "2020-04-23T01:16:08.000Z",
3+
"@timestamp": "2020-04-23T01:16:08.000-02:00",
44
"destination.as.number": 15169,
55
"destination.as.organization.name": "Google LLC",
66
"destination.bytes": 0,
@@ -21,7 +21,8 @@
2121
"event.kind": "event",
2222
"event.module": "fortinet",
2323
"event.outcome": "success",
24-
"event.start": "2020-06-24T01:16:08.000Z",
24+
"event.start": "2020-06-23T23:16:08.000-02:00",
25+
"event.timezone": "-02:00",
2526
"event.type": [
2627
"connection",
2728
"denied",
@@ -581,7 +582,7 @@
581582
]
582583
},
583584
{
584-
"@timestamp": "2019-03-31T06:42:54.000Z",
585+
"@timestamp": "2019-03-31T06:42:54.000-02:00",
585586
"destination.bytes": 0,
586587
"destination.ip": "230.1.1.2",
587588
"destination.packets": 0,
@@ -596,7 +597,8 @@
596597
"event.kind": "event",
597598
"event.module": "fortinet",
598599
"event.outcome": "success",
599-
"event.start": "2019-03-31T13:42:52.000Z",
600+
"event.start": "2019-03-31T11:42:52.000-02:00",
601+
"event.timezone": "-02:00",
600602
"event.type": [
601603
"allowed",
602604
"connection",
@@ -644,7 +646,7 @@
644646
]
645647
},
646648
{
647-
"@timestamp": "2019-05-10T14:18:54.000Z",
649+
"@timestamp": "2019-05-10T14:18:54.000-02:00",
648650
"destination.as.number": 20940,
649651
"destination.as.organization.name": "Akamai International B.V.",
650652
"destination.bytes": 0,
@@ -666,7 +668,8 @@
666668
"event.kind": "event",
667669
"event.module": "fortinet",
668670
"event.outcome": "success",
669-
"event.start": "2019-05-10T21:18:54.021Z",
671+
"event.start": "2019-05-10T19:18:54.021-02:00",
672+
"event.timezone": "-02:00",
670673
"event.type": [
671674
"connection",
672675
"end"
@@ -732,7 +735,7 @@
732735
]
733736
},
734737
{
735-
"@timestamp": "2019-05-13T11:45:04.000Z",
738+
"@timestamp": "2019-05-13T11:45:04.000-02:00",
736739
"destination.bytes": 2286,
737740
"destination.ip": "172.16.200.55",
738741
"destination.packets": 6,
@@ -747,7 +750,8 @@
747750
"event.kind": "event",
748751
"event.module": "fortinet",
749752
"event.outcome": "success",
750-
"event.start": "2019-05-13T18:45:04.815Z",
753+
"event.start": "2019-05-13T16:45:04.815-02:00",
754+
"event.timezone": "-02:00",
751755
"event.type": [
752756
"connection",
753757
"denied",
@@ -819,7 +823,7 @@
819823
]
820824
},
821825
{
822-
"@timestamp": "2019-05-13T16:29:50.000Z",
826+
"@timestamp": "2019-05-13T16:29:50.000-02:00",
823827
"destination.as.number": 42831,
824828
"destination.as.organization.name": "UK Dedicated Servers Limited",
825829
"destination.bytes": 3138,
@@ -844,7 +848,8 @@
844848
"event.kind": "event",
845849
"event.module": "fortinet",
846850
"event.outcome": "success",
847-
"event.start": "2019-05-13T23:29:50.452Z",
851+
"event.start": "2019-05-13T21:29:50.452-02:00",
852+
"event.timezone": "-02:00",
848853
"event.type": [
849854
"connection",
850855
"denied",
@@ -906,7 +911,7 @@
906911
]
907912
},
908913
{
909-
"@timestamp": "2019-05-15T17:58:10.000Z",
914+
"@timestamp": "2019-05-15T17:58:10.000-02:00",
910915
"destination.bytes": 9112,
911916
"destination.ip": "172.16.200.55",
912917
"destination.packets": 8,
@@ -921,7 +926,8 @@
921926
"event.kind": "event",
922927
"event.module": "fortinet",
923928
"event.outcome": "success",
924-
"event.start": "2019-05-16T00:58:09.000Z",
929+
"event.start": "2019-05-15T22:58:09.000-02:00",
930+
"event.timezone": "-02:00",
925931
"event.type": [
926932
"connection",
927933
"denied",
@@ -984,7 +990,7 @@
984990
]
985991
},
986992
{
987-
"@timestamp": "2019-05-15T17:45:34.000Z",
993+
"@timestamp": "2019-05-15T17:45:34.000-02:00",
988994
"destination.as.number": 16509,
989995
"destination.as.organization.name": "Amazon.com, Inc.",
990996
"destination.bytes": 5266,
@@ -1009,7 +1015,8 @@
10091015
"event.kind": "event",
10101016
"event.module": "fortinet",
10111017
"event.outcome": "success",
1012-
"event.start": "2019-05-16T00:45:34.000Z",
1018+
"event.start": "2019-05-15T22:45:34.000-02:00",
1019+
"event.timezone": "-02:00",
10131020
"event.type": [
10141021
"connection",
10151022
"denied",

0 commit comments

Comments
 (0)