Skip to content

Add Suricata package#186

Merged
mtojek merged 8 commits intoelastic:masterfrom
andrewkroh:feature/suricata-package
Aug 5, 2020
Merged

Add Suricata package#186
mtojek merged 8 commits intoelastic:masterfrom
andrewkroh:feature/suricata-package

Conversation

@andrewkroh
Copy link
Copy Markdown
Member

@andrewkroh andrewkroh commented Jul 21, 2020 •
edited
Loading

What does this PR do?

Import the Suricata Filebeat module via PACKAGES=suricata mage -v ImportBeats.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all datasets collect metrics or logs.

Related issues

Screenshots

Screen Shot 2020-07-21 at 5 22 18 PM

Screen Shot 2020-07-21 at 5 22 30 PM

@andrewkroh andrewkroh added the enhancement New feature or request label Jul 21, 2020
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Jul 21, 2020 •
edited
Loading

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Branch indexing]

  • Start Time: 2020-08-05T01:45:07.478+0000

  • Duration: 4 min 55 sec

andrewstucki
andrewstucki reviewed Jul 21, 2020
View reviewed changes
packages/suricata/dataset/eve/agent/stream/log.yml.hbs Outdated
Copy link
Copy Markdown

@andrewstucki andrewstucki Jul 21, 2020 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, just to make sure -- this will actually resolve to foo, bar, baz if it's given an array like ["foo", "bar", "baz"] (notice no brackets in the rendered template, see example).

Does filebeat automatically do string splitting for the tags part of the configuration? If not I think this needs to become something like:

tags:
{{#each tags as |tag i|}}
 - {{tag}}
{{/each}}

Copy link
Copy Markdown
Member Author

@andrewkroh andrewkroh Jul 30, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed. Thanks.

@andrewstucki andrewstucki mentioned this pull request Jul 23, 2020
Merged
@andrewkroh andrewkroh mentioned this pull request Jul 23, 2020
Merged
3 tasks
@andrewkroh
Add Suricata package
a08f376 
Import the Suricata Filebeat module via `PACKAGES=suricata mage -v ImportBeats`.
@andrewkroh
Update dashboards
ba6346c
@andrewkroh
Fix config and require 7.10.0
3734c25
@andrewkroh andrewkroh marked this pull request as ready for review July 30, 2020 21:45
@andrewkroh
Copy link
Copy Markdown
Member Author

andrewkroh commented Jul 30, 2020

Where should the fields that Filebeat adds be defined? Things like input.type are not in the index template.

Screen Shot 2020-07-30 at 5 46 39 PM

Additionally there could be fields from processors like add_host_metadata or add_docker_metadata? Is it the responsibility of each package to define these?

@andrewkroh
Copy link
Copy Markdown
Member Author

andrewkroh commented Jul 30, 2020

This module reads log files. Some of the log lines are metrics about the software. These documents have event.kind: metric. Should they have dataset.type: metrics or dataset.type: logs? If dataset.type: metrics then how would I accomplish this?

@ruflin
Copy link
Copy Markdown
Contributor

ruflin commented Jul 31, 2020 •
edited
Loading

@andrewkroh At the moment it is the responsibility of each package / dataset to add these fields.

@andrewkroh
Copy link
Copy Markdown
Member Author

andrewkroh commented Aug 4, 2020

This has been updated to add the datastream.* fields.

andrewstucki
andrewstucki approved these changes Aug 4, 2020
View reviewed changes
Copy link
Copy Markdown

@andrewstucki andrewstucki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does this need container.id? I notice that filebeat is putting that in too. Other than that, LGTM

mtojek
mtojek approved these changes Aug 5, 2020
View reviewed changes
Copy link
Copy Markdown
Contributor

@mtojek mtojek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, I will merge this PR before introducing any breaking changes in the solution.

@mtojek mtojek merged commit bb5be79 into elastic:master Aug 5, 2020
@andrewkroh andrewkroh mentioned this pull request Aug 6, 2020
Merged
3 tasks
@andrewkroh andrewkroh added Integration:suricata Suricata New Integration Issue or pull request for creating a new integration package. labels Aug 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

2 more reviewers

@andrewstucki andrewstucki andrewstucki approved these changes

@mtojek mtojek mtojek approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

enhancement New feature or request Integration:suricata Suricata New Integration Issue or pull request for creating a new integration package.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@andrewkroh @elasticmachine @ruflin @andrewstucki @mtojek