Skip to content

[system] Make event.original optional for application, security, and system ata streams#990

Merged
marc-gr merged 1 commit intoelastic:masterfrom
marc-gr:security-eventoriginal
May 17, 2021
Merged

[system] Make event.original optional for application, security, and system ata streams#990
marc-gr merged 1 commit intoelastic:masterfrom
marc-gr:security-eventoriginal

Conversation

@marc-gr
Copy link
Copy Markdown
Contributor

@marc-gr marc-gr commented May 14, 2021 •
edited
Loading

What does this PR do?

Makes event.original optional for application, security, and system data streams.

NOTE: In this case, event.original is already present from the winlog and httpjson inputs.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.

Related issues

Screenshots

image

image

@marc-gr marc-gr added enhancement New feature or request Team:Integrations Label for the Integrations team Team:Security-External Integrations labels May 14, 2021
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented May 14, 2021

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented May 14, 2021

Pinging @elastic/integrations (Team:Integrations)

@marc-gr marc-gr changed the title [system] Make event.original optional for application, security, and system da… [system] Make event.original optional for application, security, and system ata streams May 14, 2021
@marc-gr marc-gr force-pushed the security-eventoriginal branch from 885c9f7 to a57ef2b Compare May 14, 2021 11:05
@marc-gr marc-gr mentioned this pull request May 14, 2021
Closed
43 tasks
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented May 14, 2021 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #990 updated

  • Start Time: 2021-05-14T11:05:55.462+0000

  • Duration: 10 min 17 sec

  • Commit: a57ef2b

Test stats 🧪

Test Results
Failed 0
Passed 264
Skipped 0
Total 264

Trends 🧪

Image of Build Times

Image of Tests

@djptek
Copy link
Copy Markdown
Contributor

djptek commented May 14, 2021

Hi @marc-gr we have an RFC open to Deprecate log.original since in the majority of cases that field could equally be captured as event.original

From a quick grep it looks like event.original has more weight in integrations

% grep -Rw "log.original" ~/git/integrations/packages | wc
     135    3164   32774
% grep -Rw "event.original" ~/git/integrations/packages | wc
     263    2027   41656

I just wanted to check in, in case you might intend to rely on log.original as a result of this PR

@marc-gr
Copy link
Copy Markdown
Contributor Author

marc-gr commented May 14, 2021

hey @djptek!

This is part of an effort to be consistent about the way we deal with event.original in general, and the intent is to do not add it by default but have a toggle in all packages to let users enable it at will (#777).

Hope it makes sense 😄

@djptek
Copy link
Copy Markdown
Contributor

djptek commented May 14, 2021

Thanks @marc-gr makes a lot of sense saving resource, I just wanted to check that users would not opt out of event.original on the expectation that they could recover the data from log.original at some point in the future 👍

P1llus
P1llus approved these changes May 17, 2021
View reviewed changes
Copy link
Copy Markdown
Member

@P1llus P1llus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@marc-gr marc-gr merged commit 54d06dd into elastic:master May 17, 2021
@marc-gr marc-gr deleted the security-eventoriginal branch May 17, 2021 13:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@P1llus P1llus P1llus approved these changes

Assignees

No one assigned

Labels

enhancement New feature or request Team:Integrations Label for the Integrations team

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@marc-gr @elasticmachine @djptek @P1llus