Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

journald: add missing source.ip and host.ip ECS fields #12166

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

mauri870
Copy link
Member

@mauri870 mauri870 commented Dec 19, 2024

Proposed commit message

This commit adds the missing ECS mappings for source.ip and host.ip. Since these fields were not mapped, they defaulted to keyword in logs from journald, causing conflicts in the data view.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test

Maybe there is a faster way, but what I did is the following:

  • Deploy a 8.12.1 cloud stack
  • Enroll an agent
  • Install the journald integration in the agent policy
  • In Discover, visualize the host.ip field, it shows as conflict (keyword, ip)
  • Package the integration and deploy to the existing cluster: elastic-package install --zip ./integrations/build/packages/journald-1.1.1.zip -v
  • Update the integration in the agent policy
  • In the new index after the rollover, confirm that mappings are correct (host.ip and source.ip are shown as ip)
  • Delete the old conflicting index
  • Check new data in Kibana, source.ip and host.ip are shown as ip and no conflict is reported.

Related issues

Screenshots

@mauri870 mauri870 added bug Something isn't working, use only for issues Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team [elastic/elastic-agent-data-plane] labels Dec 19, 2024
@mauri870 mauri870 self-assigned this Dec 19, 2024
@mauri870 mauri870 force-pushed the journald-source-host-ip branch from a240ccc to 3926b61 Compare December 19, 2024 13:54
@andrewkroh andrewkroh added bugfix Pull request that fixes a bug issue Integration:journald Custom Journald logs and removed bug Something isn't working, use only for issues labels Dec 19, 2024
@elasticmachine
Copy link

💚 Build Succeeded

cc @mauri870

@mauri870 mauri870 marked this pull request as ready for review December 19, 2024 15:10
@mauri870 mauri870 requested a review from a team as a code owner December 19, 2024 15:10
@mauri870 mauri870 requested review from faec and leehinman December 19, 2024 15:10
@elasticmachine
Copy link

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bugfix Pull request that fixes a bug issue Integration:journald Custom Journald logs Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team [elastic/elastic-agent-data-plane]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[journald] ECS conflicts with host.ip and source.ip fields
3 participants