Skip to content

Check expand_event_list_from_field when json in map[string]interface{} format#20370

Merged
kaiyan-sheng merged 3 commits intoelastic:masterfrom
kaiyan-sheng:fix_s3
Jul 31, 2020
Merged

Check expand_event_list_from_field when json in map[string]interface{} format#20370
kaiyan-sheng merged 3 commits intoelastic:masterfrom
kaiyan-sheng:fix_s3

Conversation

@kaiyan-sheng
Copy link
Copy Markdown
Contributor

@kaiyan-sheng kaiyan-sheng commented Jul 30, 2020 •
edited
Loading

What does this PR do?

When json is in map[string]interface{} format, s3 input should also check for expand_event_list_from_field config parameter.
With this PR, cloudtrail fileset is working again:
Screen Shot 2020-07-30 at 7 11 09 PM

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jul 30, 2020
@kaiyan-sheng kaiyan-sheng self-assigned this Jul 30, 2020
@kaiyan-sheng kaiyan-sheng added the Team:Platforms Label for the Integrations - Platforms team label Jul 30, 2020
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 30, 2020

Pinging @elastic/integrations-platforms (Team:Platforms)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 30, 2020
@kaiyan-sheng kaiyan-sheng added needs_backport PR is waiting to be backported to other branches. review labels Jul 30, 2020
leehinman
leehinman approved these changes Jul 31, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@leehinman leehinman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Jul 31, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #20370 updated]

  • Start Time: 2020-07-31T01:16:06.822+0000

  • Duration: 51 min 52 sec

Test stats 🧪

Test Results
Failed 0
Passed 2438
Skipped 397
Total 2835

@kaiyan-sheng kaiyan-sheng mentioned this pull request Jul 31, 2020
Closed
@kaiyan-sheng kaiyan-sheng merged commit 2ced454 into elastic:master Jul 31, 2020
@kaiyan-sheng kaiyan-sheng deleted the fix_s3 branch July 31, 2020 03:00
@kaiyan-sheng kaiyan-sheng mentioned this pull request Jul 31, 2020
Merged
6 tasks
@kaiyan-sheng kaiyan-sheng added v7.9.0 and removed needs_backport PR is waiting to be backported to other branches. labels Jul 31, 2020
@kaiyan-sheng kaiyan-sheng mentioned this pull request Jul 31, 2020
Merged
6 tasks
v1v added a commit to v1v/beats that referenced this pull request Jul 31, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into feature/ci-pipeli…
e25ba73 
…ne-2.0

* upstream/master:
  Check expand_event_list_from_field when json in map[string]interface{} format (elastic#20370)
  [docs] Remove deprecated security roles (elastic#20162)
  Modify doc in app_insights metricset (elastic#20185)
v1v added a commit to v1v/beats that referenced this pull request Jul 31, 2020
@v1v
Merge remote-tracking branch 'upstream/master' into fix/ci-tools-inst…
8f9d230 
…allation

* upstream/master:
  Check expand_event_list_from_field when json in map[string]interface{} format (elastic#20370)
  [docs] Remove deprecated security roles (elastic#20162)
  Modify doc in app_insights metricset (elastic#20185)
  [Elastic Agent] Add skeleton for client/server for agent control protocol (elastic#20163)
  Auditbeat: Allow multiple instances by grouping kprobes by PID (elastic#20325)
  [Filebeat][Fortinet] Remove pre populated event.timezone (elastic#20273)
  Add an explicit system test for processes on unix systems (elastic#20320)
kaiyan-sheng pushed a commit that referenced this pull request Jul 31, 2020
Cherry-pick #20370 to 7.9: Check expand_event_list_from_field when js…
bef2263 
…on in map[string]interface{} format (#20373)

(cherry picked from commit 2ced454)
kaiyan-sheng pushed a commit that referenced this pull request Jul 31, 2020
Check expand_event_list_from_field when json in map[string]interface{…
b9a5aa7 
…} format (#20370) (#20374)

(cherry picked from commit 2ced454)
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
@melchiormoulin
Check expand_event_list_from_field when json in map[string]interface{…
5d8138c 
…} format (elastic#20370)
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
Cherry-pick elastic#20370 to 7.9: Check expand_event_list_from_field …
ddd9f21 
…when json in map[string]interface{} format (elastic#20373)

(cherry picked from commit c39dde3)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leehinman leehinman leehinman approved these changes

Assignees

@kaiyan-sheng kaiyan-sheng

Labels

review Team:Platforms Label for the Integrations - Platforms team v7.9.0 v7.10.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kaiyan-sheng @elasticmachine @leehinman