Rename auditd fields for ECS#10577
Conversation
webmat
left a comment
There was a problem hiding this comment.
I'm good with event.original.
I'm not convinced for error.message, but let me know if I'm misunderstanding this one.
There was a problem hiding this comment.
Not a fan of using error.message for debugging output. It's not an actual error message from the source, nor is it a processing error, really, according to the description below.
There was a problem hiding this comment.
It's a processing error. For example, message would be included if an expected field were missing while processing the events from the kernel. It holds any of the error messages that are returned by go-libaudit while processing the messages.
There was a problem hiding this comment.
Gotcha, I'm good with that, then.
Change `auditd.messages` to `event.original` and `auditd.warnings` to `error.message`. And also change `user.user_information` from text to keyword.
84404be to
c5fb6fa
Compare
webmat
left a comment
There was a problem hiding this comment.
I'm good with this, once the pull request link is fixed :-)
|
Will fix. I did a rebase and lost the fix. |
|
Only Jenkins failure is metricbeat. Unrelated |
Change
auditd.messagestoevent.originalandauditd.warningstoerror.message.And also change
user.user_informationfrom text to keyword.