Skip to content

Commit cd85049

Browse files
author
lucian-ioan
committed
rewrite pipeline with painless script
1 parent 9d8a3ef commit cd85049

File tree

2 files changed

+33
-51
lines changed

2 files changed

+33
-51
lines changed

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json‎

Lines changed: 19 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -44,17 +44,13 @@
4444
"recipient_account_id": "111111111111",
4545
"request_id": "b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE",
4646
"request_parameters": "{incomingTransitiveTags={Department=Engineering}, transitiveTagKeys=[Email, CostCenter], durationSeconds=3600, roleArn=arn:aws:iam::111111111111:role/JohnRole2, roleSessionName=Role2WithTags, tags=[{value=johndoe@example.com, key=Email}, {value=12345, key=CostCenter}]}",
47-
"resources": {
48-
"account_id": [
49-
"111111111111"
50-
],
51-
"arn": [
52-
"arn:aws:iam::111122223333:role/JohnRole2"
53-
],
54-
"type": [
55-
"AWS::IAM::Role"
56-
]
57-
},
47+
"resources": [
48+
{
49+
"account_id": "111111111111",
50+
"arn": "arn:aws:iam::111122223333:role/JohnRole2",
51+
"type": "AWS::IAM::Role"
52+
}
53+
],
5854
"response_elements": "{assumedRoleUser={assumedRoleId=AROAIFR7WHDTSOYQYHFUE:Role2WithTags, arn=arn:aws:sts::111111111111:assumed-role/test-role/Role2WithTags}, credentials={accessKeyId=ASIAWHOJDLGPOEXAMPLE, sessionToken=AgoJb3JpZ2luX2VjEB4aCXVzLXdlc3QtMSJHMEXAMPLETOKEN+//rJb8Lo30mFc5MlhFCEbubZvEj0wHB/mDMwIgSEe9gk/Zjr09tZV7F1HDTMhmEXAMPLETOKEN/iEJ/rkqngII9///////////ARABGgw0MjgzMDc4NjM5NjYiDLZjZFKwP4qxQG5sFCryASO4UPz5qE97wPPH1eLMvs7CgSDBSWfonmRTCfokm2FN1+hWUdQQH6adjbbrVLFL8c3jSsBhQ383AvxpwK5YRuDE1AI/+C+WKFZb701eiv9J5La2EXAMPLETOKEN/c7S5Iro1WUJ0q3Cxuo/8HUoSxVhQHM7zF7mWWLhXLEQ52ivL+F6q5dpXu4aTFedpMfnJa8JtkWwG9x1Axj0Ypy2ok8v5unpQGWych1vwdvj6ez1Dm8Xg1+qIzXILiEXAMPLETOKEN/vQGqu8H+nxp3kabcrtOvTFTvxX6vsc8OGwUfHhzAfYGEXAMPLETOKEN/L6v1yMM3B1OwFOrQBno1HEjf1oNI8RnQiMNFdUOtwYj7HUZIOCZmjfN8PPHq77N7GJl9lzvIZKQA0Owcjg+mc78zHCj8y0siY8C96paEXAMPLETOKEN/E3cpksxWdgs91HRzJWScjN2+r2LTGjYhyPqcmFzzo2mCE7mBNEXAMPLETOKEN/oJy+2o83YNW5tOiDmczgDzJZ4UKR84yGYOMfSnF4XcEJrDgAJ3OJFwmTcTQICAlSwLEXAMPLETOKEN, expiration=Oct 2, 2019 11:12:29 PM}}",
5955
"user_identity": {
6056
"access_key_id": "AKIAI44QH8DHBEXAMPLE",
@@ -178,19 +174,18 @@
178174
"recipient_account_id": "111111111111",
179175
"request_id": "b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE",
180176
"request_parameters": "{incomingTransitiveTags={Department=Engineering}, transitiveTagKeys=[Email, CostCenter], durationSeconds=3600, roleArn=arn:aws:iam::111111111111:role/JohnRole2, roleSessionName=Role2WithTags, tags=[{value=johndoe@example.com, key=Email}, {value=12345, key=CostCenter}]}",
181-
"resources": {
182-
"account_id": [
183-
"444455556666"
184-
],
185-
"arn": [
186-
"arn:aws:iam::444455556666:role/SAMLTestRoleShibboleth",
187-
"arn:aws:iam::444455556666:saml-provider/test-saml-provider"
188-
],
189-
"type": [
190-
"AWS::IAM::Role",
191-
"AWS::IAM::SAMLProvider"
192-
]
193-
},
177+
"resources": [
178+
{
179+
"account_id": "444455556666",
180+
"arn": "arn:aws:iam::444455556666:role/SAMLTestRoleShibboleth",
181+
"type": "AWS::IAM::Role"
182+
},
183+
{
184+
"account_id": "444455556666",
185+
"arn": "arn:aws:iam::444455556666:saml-provider/test-saml-provider",
186+
"type": "AWS::IAM::SAMLProvider"
187+
}
188+
],
194189
"response_elements": "{assumedRoleUser={assumedRoleId=AROAIFR7WHDTSOYQYHFUE:Role2WithTags, arn=arn:aws:sts::111111111111:assumed-role/test-role/Role2WithTags}, credentials={accessKeyId=ASIAWHOJDLGPOEXAMPLE, sessionToken=AgoJb3JpZ2luX2VjEB4aCXVzLXdlc3QtMSJHMEXAMPLETOKEN+//rJb8Lo30mFc5MlhFCEbubZvEj0wHB/mDMwIgSEe9gk/Zjr09tZV7F1HDTMhmEXAMPLETOKEN/iEJ/rkqngII9///////////ARABGgw0MjgzMDc4NjM5NjYiDLZjZFKwP4qxQG5sFCryASO4UPz5qE97wPPH1eLMvs7CgSDBSWfonmRTCfokm2FN1+hWUdQQH6adjbbrVLFL8c3jSsBhQ383AvxpwK5YRuDE1AI/+C+WKFZb701eiv9J5La2EXAMPLETOKEN/c7S5Iro1WUJ0q3Cxuo/8HUoSxVhQHM7zF7mWWLhXLEQ52ivL+F6q5dpXu4aTFedpMfnJa8JtkWwG9x1Axj0Ypy2ok8v5unpQGWych1vwdvj6ez1Dm8Xg1+qIzXILiEXAMPLETOKEN/vQGqu8H+nxp3kabcrtOvTFTvxX6vsc8OGwUfHhzAfYGEXAMPLETOKEN/L6v1yMM3B1OwFOrQBno1HEjf1oNI8RnQiMNFdUOtwYj7HUZIOCZmjfN8PPHq77N7GJl9lzvIZKQA0Owcjg+mc78zHCj8y0siY8C96paEXAMPLETOKEN/E3cpksxWdgs91HRzJWScjN2+r2LTGjYhyPqcmFzzo2mCE7mBNEXAMPLETOKEN/oJy+2o83YNW5tOiDmczgDzJZ4UKR84yGYOMfSnF4XcEJrDgAJ3OJFwmTcTQICAlSwLEXAMPLETOKEN, expiration=Oct 2, 2019 11:12:29 PM}}",
195190
"user_identity": {
196191
"access_key_id": "AKIAI44QH8DHBEXAMPLE",

‎packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 14 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -234,33 +234,20 @@ processors:
234234
field: json.readOnly
235235
target_field: aws.cloudtrail.read_only
236236
ignore_failure: true
237-
- foreach:
238-
field: json.resources
239-
if: ctx.json?.resources instanceof List
240-
ignore_failure: true
241-
processor:
242-
append:
243-
field: aws.cloudtrail.resources.arn
244-
value: '{{{_ingest._value.ARN}}}'
245-
allow_duplicates: false
246-
- foreach:
247-
field: json.resources
248-
if: ctx.json?.resources instanceof List
249-
ignore_failure: true
250-
processor:
251-
append:
252-
field: aws.cloudtrail.resources.account_id
253-
value: '{{{_ingest._value.accountId}}}'
254-
allow_duplicates: false
255-
- foreach:
256-
field: json.resources
257-
if: ctx.json?.resources instanceof List
258-
ignore_failure: true
259-
processor:
260-
append:
261-
field: aws.cloudtrail.resources.type
262-
value: '{{{_ingest._value.type}}}'
263-
allow_duplicates: false
237+
- script:
238+
lang: painless
239+
source: >
240+
if (ctx.json?.resources instanceof List) {
241+
for (int i = 0; i < ctx.json.resources.size(); i++) {
242+
if (ctx.json.resources[i].containsKey('ARN')) {
243+
ctx.json.resources[i].arn = ctx.json.resources[i].remove('ARN');
244+
}
245+
if (ctx.json.resources[i].containsKey('accountId')) {
246+
ctx.json.resources[i].account_id = ctx.json.resources[i].remove('accountId');
247+
}
248+
// No need for renaming 'type' as it would be the same.
249+
}
250+
}
264251
- rename:
265252
field: json.resources
266253
target_field: aws.cloudtrail.resources

0 commit comments

Comments
 (0)