[Auditbeat] Cherry-pick #9732 to 6.x: User metricset: Fetch groups by user#9870
Merged
cwurm merged 1 commit intoelastic:6.xfrom Jan 4, 2019
Merged
[Auditbeat] Cherry-pick #9732 to 6.x: User metricset: Fetch groups by user#9870cwurm merged 1 commit intoelastic:6.xfrom
cwurm merged 1 commit intoelastic:6.xfrom
Conversation
Changes the user metricset to looking up groups by user instead of users by groups. Also changes the types of the system.audit.user.uid and system.audit.user.gid fields from integer to keyword to accommodate Windows in the future. Fixes elastic#9679. (cherry picked from commit 42421e9)
Contributor
|
Pinging @elastic/secops |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of PR #9732 to 6.x branch. Original message:
Currently, the
usermetricset reads all users, then reads all groups and their members and matches one to the other. This can be a problem when groups have a lot of members (see #9679).This changes to looking up groups of individual users.
It also changes the types of the
system.audit.user.uidandsystem.audit.user.gidfields fromintegertokeywordto accommodate Windows in the future (Go'sUserandGroupstructs usestrings, so does ECSuser.id/group.id).Because the internal structure of the
Userstruct changes, this invalidates previousbeat.dbfiles. I have not added any conversion logic this time since this metricset is not released yet - but we will have to do it in the future.Fixes #9679.