Skip to content

Cherry-pick #21388 to 7.9: [Filebeat] Add field limit check for AWS Cloudtrail flattened fields#21432

Merged
leehinman merged 1 commit intoelastic:7.9from
leehinman:backport_21388_7.9
Sep 30, 2020
Merged

Cherry-pick #21388 to 7.9: [Filebeat] Add field limit check for AWS Cloudtrail flattened fields#21432
leehinman merged 1 commit intoelastic:7.9from
leehinman:backport_21388_7.9

Conversation

@leehinman
Copy link
Copy Markdown
Contributor

@leehinman leehinman commented Sep 30, 2020 •
edited by zube bot
Loading

Cherry-pick of PR #21388 to 7.9 branch. Original message:

What does this PR do?

Adds a 32k length check for:

  • aws.cloudtrail.flattened.request_parameters
  • aws.cloudtrail.flattened.response_elements
  • aws.cloudtrail.flattened.additional_eventdata
  • aws.cloudtrail.flattened.service_event_details

Why is it important?

Elasticsearch will fail to index the document if a flattened field is
over 32k in length.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

TESTING_FILEBEAT_MODULES=aws TESTING_FILEBEAT_FILESETS=cloudtrail mage -v pythonIntegTest

Related issues

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Sep 30, 2020

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Sep 30, 2020
@leehinman
Add field limit check for AWS Cloudtrail flattened fields (elastic#21388
9b783d3 
)

add 32k length check for
  - aws.cloudtrail.flattened.request_parameters
  - aws.cloudtrail.flattened.response_elements
  - aws.cloudtrail.flattened.additional_eventdata
  - aws.cloudtrail.flattened.service_event_details

Closes elastic#21382

(cherry picked from commit eae9f5c)
kaiyan-sheng
kaiyan-sheng reviewed Sep 30, 2020
View reviewed changes
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Sep 30, 2020 •
edited by jenkins-beats-ci bot
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #21432 updated]

  • Start Time: 2020-09-30T18:25:09.473+0000

  • Duration: 59 min 34 sec

Test stats 🧪

Test Results
Failed 0
Passed 1896
Skipped 257
Total 2153

@leehinman leehinman merged commit b6b07de into elastic:7.9 Sep 30, 2020
@leehinman leehinman deleted the backport_21388_7.9 branch October 5, 2020 19:06
@zube zube bot removed the [zube]: Done label Dec 30, 2020
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@leehinman
Add field limit check for AWS Cloudtrail flattened fields (elastic#21388
603bbf8 
) (elastic#21432)

add 32k length check for
  - aws.cloudtrail.flattened.request_parameters
  - aws.cloudtrail.flattened.response_elements
  - aws.cloudtrail.flattened.additional_eventdata
  - aws.cloudtrail.flattened.service_event_details

Closes elastic#21382

(cherry picked from commit bfed554)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@kaiyan-sheng kaiyan-sheng kaiyan-sheng approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

backport

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@leehinman @elasticmachine @kaiyan-sheng