Add ISO8601 as supported timestamp type#25564
Merged
leehinman merged 4 commits intoelastic:masterfrom Jun 10, 2021
Merged
Conversation
Contributor
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
Trends 🧪💚 Flaky test reportTests succeeded. Expand to view the summary
Test stats 🧪
|
Contributor
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
Contributor
|
This pull request is now in conflicts. Could you fix it? 🙏 |
leehinman
approved these changes
Jun 9, 2021
mergify bot
pushed a commit
that referenced
this pull request
Jun 10, 2021
* Add ISO8601 as supported timestamp type Co-authored-by: Lee E. Hinman <lee.e.hinman@elastic.co> (cherry picked from commit 7edb457)
3 tasks
leehinman
pushed a commit
that referenced
this pull request
Jun 10, 2021
leehinman
added a commit
to leehinman/integrations
that referenced
this pull request
Jun 17, 2021
leehinman
added a commit
to elastic/integrations
that referenced
this pull request
Jun 17, 2021
mdelapenya
added a commit
to mdelapenya/beats
that referenced
this pull request
Jun 21, 2021
* master: (26 commits) Report total and free CPU for vSphere virtual machines (elastic#26167) [filebeat] Add preserve_original_event option to o365audit input (elastic#26273) Change xml processor names in script processor to match convention (elastic#26263) [Oracle] Fixing default values for paths in config template (elastic#26276) Add more ECS fields to logs (elastic#25998) [Heartbeat] Fix broken invocation of synth package (elastic#26228) rename sqs file name (elastic#26227) Populate the agent action result if there is no matching action handlers (elastic#26152) Add ISO8601 as supported timestamp type (elastic#25564) Move Filebeat azure module to GA (elastic#26168) Filebeat azure module pipeline fixes and changes (elastic#26148) libbeat: monitor version (elastic#26214) Add new parser to filestream input: container (elastic#26115) [Metricbeat] Add state_statefulset replicas.ready (elastic#26088) Disable test processors system test for windows 10 (elastic#26216) Fix startup with failing configuration (elastic#26126) Remove 32 bits version of Elastic Agent. (elastic#25708) Chane fleetmode detection to ony use management.enabled (elastic#26180) Make `filestream` input GA (elastic#26127) libbeat/idxmgmt/ilm: fix alias creation (elastic#26146) ...
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enhancement
What does this PR do?
This PR allows the ability to parse Zeek logs that are written with ISO8601 timestamps.
Why is it important?
ISO8601 timestamps provide a way to view raw log timestamps easily. By being able to keep these timestamps in the raw logs and have them be parsed correctly when being ingested into the Elastic ecosystem, we get the best of both worlds.
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.How to test this PR locally
Redef
LogAscii::json_timestamps = JSON::TS_ISO8601;for Zeek and have it write logs with ISO8601 timestamps.The
dateprocessor will fail for thetsfield, etc.Apply
ISO8601as an additional format option forts, etc inpipeline.yml.Verify log is correctly parsed and ingested into Elasticsearch.