Conversation
This allows 6.6 / 6.7 data to be compatible with 7.x.
|
Pinging @elastic/infrastructure |
graphaelli
left a comment
There was a problem hiding this comment.
any need to enforce that event.dataset is always fileset.module + fileset.name (say with a test)?
| "suricata" | ||
| ], | ||
| "url.hostname": "example.net", | ||
| "url.hostname": "example.net", |
There was a problem hiding this comment.
bunch of these extra spaces, not sure if you care
There was a problem hiding this comment.
the files are auto generated so more wonder why there were missing before :-)
There was a problem hiding this comment.
Ah I may have saved it in a commit, before I was familiar with the Beats integration tests :-)
| - name: event.dataset | ||
| description: > | ||
| The Filebeat dataset that generated this event. | ||
|
|
There was a problem hiding this comment.
Nice, so we have per-Beat override 👍
|
@graphaelli Good question about the test. I don't think we should enforce it (event though at the moment it is because it's in the code). More important for me is that it's correct in the generate files. Ok if for now we skip a test? |
|
sounds reasonable to me |
This allows 6.6 / 6.7 data to be compatible with 7.x.