Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support Fixed length extraction #17191

Merged

Conversation

newly12
Copy link
Contributor

@newly12 newly12 commented Mar 23, 2020

What does this PR do?

This PR allows dissect processor to do fixed-length field extraction.

Why is it important?

Before this PR dissect does not provide such ability.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works

Related issues

Fixes elastic/dissect-specification#6

@elasticmachine
Copy link
Collaborator

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

1 similar comment
@elasticmachine
Copy link
Collaborator

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

@cla-checker-service
Copy link

cla-checker-service bot commented Mar 23, 2020

💚 CLA has been signed

@ycombinator
Copy link
Contributor

Hi @newly12, thank you for your contribution. In order to proceed with reviewing this PR and accepting your contribution, we first need to you to sign the Elastic Contributor License Agreement (CLA): https://www.elastic.co/contributor-agreement. Thanks!

@ycombinator ycombinator added :Processors libbeat Team:Services (Deprecated) Label for the former Integrations-Services team labels Mar 24, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations-services (Team:Services)

@vjsamuel
Copy link
Contributor

@ycombinator, I will work with our internal legal team to have @newly12 added to our corporate CLA by EOD thursday.

@ycombinator
Copy link
Contributor

Sounds good, thanks @vjsamuel!

@@ -30,7 +30,7 @@ an error; you need to either drop or rename the key before using dissect.
For tokenization to be successful, all keys must be found and extracted, if one of them cannot be
found an error will be logged and no modification is done on the original event.

NOTE: A key can contain any characters except reserved suffix or prefix modifiers: `/`,`&`, `+`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you also add the # modifier to the table of modifiers further down in this same file? Also please add a section for fixed length extraction similar to sections for the other modifiers.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ycombinator I failed to find sections for modifier in this file, could you please point me to that? thx!

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm sorry, I was looking at the Elasticsearch dissect processor's documentation (https://www.elastic.co/guide/en/elasticsearch/reference/master/dissect-processor.html) when I made that comment. You're right, there is no such section in the Beat's dissect processor's documentation (https://www.elastic.co/guide/en/beats/filebeat/7.6/dissect.html). 🤦

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the info. It is pretty good doc for dissect processor! It will be good to have similar doc in beats or a link to the modfier part..

@ycombinator
Copy link
Contributor

Hi @newly12, thanks for this contribution! The code and tests look great; I just added a couple of comments about adding docs, etc.

Also, please add an entry to the CHANGELOG.next.asciidoc file, under the Added > Affecting all Beats section.

Thanks again!

@newly12 newly12 force-pushed the dissect_supports_fixed_length_extraction branch 2 times, most recently from 1cbbe63 to 1814167 Compare April 30, 2020 02:20
@newly12
Copy link
Contributor Author

newly12 commented Apr 30, 2020

Hi @ycombinator thanks a lot for reviewing this! I've updated CHANGELOG.next.asciidoc and left a comment regarding modifier doc. Please kindly help check.

Signed-off-by: Peter Deng <yundeng@ebay.com>
@newly12 newly12 force-pushed the dissect_supports_fixed_length_extraction branch from 1814167 to 1b563cc Compare April 30, 2020 03:26
@elasticmachine
Copy link
Collaborator

💔 Build Failed

Pipeline View Test View Changes Artifacts preview stats

Expand to view the summary

Build stats

Steps errors

Expand to view the steps failures

  • Name: Error signal
    • Description:

    • Result: FAILURE

    • Duration: 0 min 0 sec<

    • Start Time: 2020-04-30T03:31:27.342+0000

Log output

Expand to view the last 100 lines of log output

[2020-04-30T03:31:24.287Z]  * [new tag]         v7.5.2     -> v7.5.2
[2020-04-30T03:31:24.287Z]  * [new tag]         v7.6.0     -> v7.6.0
[2020-04-30T03:31:24.287Z]  * [new tag]         v7.6.1     -> v7.6.1
[2020-04-30T03:31:24.287Z]  * [new tag]         v7.6.2     -> v7.6.2
[2020-04-30T03:31:24.287Z]  * [new tag]         v5.0.0-alpha5 -> v5.0.0-alpha5
[2020-04-30T03:31:25.162Z] + git rev-parse HEAD
[2020-04-30T03:31:25.513Z] + git rev-parse HEAD
[2020-04-30T03:31:25.810Z] + git rev-parse origin/pr/17191
[2020-04-30T03:31:25.850Z] [INFO] githubEnv: Found Git Build Cause: pr
[2020-04-30T03:31:26.216Z] Masking supported pattern matches of $GITHUB_TOKEN
[2020-04-30T03:31:27.139Z] [INFO] githubPrCheckApproved: Title: Support Fixed length extraction - User: newly12 - Author Association: FIRST_TIME_CONTRIBUTOR
[2020-04-30T03:31:27.411Z] Stage "Lint" skipped due to earlier failure(s)
[2020-04-30T03:31:27.454Z] Stage "Build and Test" skipped due to earlier failure(s)
[2020-04-30T03:31:27.606Z] Stage "Elastic Agent x-pack" skipped due to earlier failure(s)
[2020-04-30T03:31:27.608Z] Stage "Elastic Agent x-pack Windows" skipped due to earlier failure(s)
[2020-04-30T03:31:27.609Z] Stage "Elastic Agent Mac OS X" skipped due to earlier failure(s)
[2020-04-30T03:31:27.609Z] Stage "Filebeat oss" skipped due to earlier failure(s)
[2020-04-30T03:31:27.610Z] Stage "Filebeat x-pack" skipped due to earlier failure(s)
[2020-04-30T03:31:27.611Z] Stage "Filebeat Mac OS X" skipped due to earlier failure(s)
[2020-04-30T03:31:27.612Z] Stage "Filebeat Windows" skipped due to earlier failure(s)
[2020-04-30T03:31:27.615Z] Stage "Heartbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.616Z] Stage "Auditbeat oss" skipped due to earlier failure(s)
[2020-04-30T03:31:27.617Z] Stage "Auditbeat x-pack" skipped due to earlier failure(s)
[2020-04-30T03:31:27.618Z] Stage "Libbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.619Z] Stage "Libbeat x-pack" skipped due to earlier failure(s)
[2020-04-30T03:31:27.620Z] Stage "Metricbeat OSS Unit tests" skipped due to earlier failure(s)
[2020-04-30T03:31:27.621Z] Stage "Metricbeat OSS Integration tests" skipped due to earlier failure(s)
[2020-04-30T03:31:27.622Z] Stage "Metricbeat Python integration tests" skipped due to earlier failure(s)
[2020-04-30T03:31:27.623Z] Stage "Metricbeat x-pack" skipped due to earlier failure(s)
[2020-04-30T03:31:27.624Z] Stage "Metricbeat crosscompile" skipped due to earlier failure(s)
[2020-04-30T03:31:27.625Z] Stage "Metricbeat Mac OS X" skipped due to earlier failure(s)
[2020-04-30T03:31:27.626Z] Stage "Metricbeat Windows" skipped due to earlier failure(s)
[2020-04-30T03:31:27.627Z] Stage "Packetbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.627Z] Stage "dockerlogbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.628Z] Stage "Winlogbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.628Z] Stage "Winlogbeat Windows x-pack" skipped due to earlier failure(s)
[2020-04-30T03:31:27.629Z] Stage "Functionbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.629Z] Stage "Journalbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.630Z] Stage "Generators" skipped due to earlier failure(s)
[2020-04-30T03:31:27.630Z] Stage "Kubernetes" skipped due to earlier failure(s)
[2020-04-30T03:31:27.695Z] Stage "Heartbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.697Z] Stage "Auditbeat oss" skipped due to earlier failure(s)
[2020-04-30T03:31:27.698Z] Stage "Libbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.699Z] Stage "Packetbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.700Z] Stage "dockerlogbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.701Z] Stage "Winlogbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.702Z] Stage "Functionbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.703Z] Stage "Journalbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:27.704Z] Stage "Generators" skipped due to earlier failure(s)
[2020-04-30T03:31:27.938Z] Failed in branch Elastic Agent x-pack
[2020-04-30T03:31:27.939Z] Failed in branch Elastic Agent x-pack Windows
[2020-04-30T03:31:27.940Z] Failed in branch Elastic Agent Mac OS X
[2020-04-30T03:31:27.940Z] Failed in branch Filebeat oss
[2020-04-30T03:31:27.941Z] Failed in branch Filebeat x-pack
[2020-04-30T03:31:27.942Z] Failed in branch Filebeat Mac OS X
[2020-04-30T03:31:27.942Z] Failed in branch Filebeat Windows
[2020-04-30T03:31:27.943Z] Failed in branch Auditbeat x-pack
[2020-04-30T03:31:27.944Z] Failed in branch Libbeat x-pack
[2020-04-30T03:31:27.945Z] Failed in branch Metricbeat OSS Unit tests
[2020-04-30T03:31:27.945Z] Failed in branch Metricbeat OSS Integration tests
[2020-04-30T03:31:27.946Z] Failed in branch Metricbeat Python integration tests
[2020-04-30T03:31:27.947Z] Failed in branch Metricbeat x-pack
[2020-04-30T03:31:27.947Z] Failed in branch Metricbeat crosscompile
[2020-04-30T03:31:27.948Z] Failed in branch Metricbeat Mac OS X
[2020-04-30T03:31:27.949Z] Failed in branch Metricbeat Windows
[2020-04-30T03:31:27.950Z] Failed in branch Winlogbeat Windows x-pack
[2020-04-30T03:31:27.950Z] Failed in branch Kubernetes
[2020-04-30T03:31:28.127Z] Stage "Heartbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:28.128Z] Stage "Auditbeat oss" skipped due to earlier failure(s)
[2020-04-30T03:31:28.129Z] Stage "Libbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:28.130Z] Stage "Winlogbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:28.131Z] Stage "Functionbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:28.132Z] Stage "Generators" skipped due to earlier failure(s)
[2020-04-30T03:31:28.173Z] Failed in branch Packetbeat
[2020-04-30T03:31:28.174Z] Failed in branch dockerlogbeat
[2020-04-30T03:31:28.175Z] Failed in branch Journalbeat
[2020-04-30T03:31:28.315Z] Stage "Heartbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:28.317Z] Stage "Auditbeat oss" skipped due to earlier failure(s)
[2020-04-30T03:31:28.318Z] Stage "Libbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:28.319Z] Stage "Functionbeat" skipped due to earlier failure(s)
[2020-04-30T03:31:28.320Z] Stage "Generators" skipped due to earlier failure(s)
[2020-04-30T03:31:28.338Z] Failed in branch Winlogbeat
[2020-04-30T03:31:28.488Z] Failed in branch Heartbeat
[2020-04-30T03:31:28.489Z] Failed in branch Libbeat
[2020-04-30T03:31:28.490Z] Failed in branch Functionbeat
[2020-04-30T03:31:28.491Z] Stage "Auditbeat oss" skipped due to earlier failure(s)
[2020-04-30T03:31:28.492Z] Stage "Generators" skipped due to earlier failure(s)
[2020-04-30T03:31:28.573Z] Failed in branch Auditbeat oss
[2020-04-30T03:31:28.574Z] Failed in branch Generators
[2020-04-30T03:31:29.077Z] Running on Jenkins in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-17191
[2020-04-30T03:31:29.305Z] [INFO] getVaultSecret: Getting secrets
[2020-04-30T03:31:29.356Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2020-04-30T03:31:30.046Z] + chmod 755 generate-build-data.sh
[2020-04-30T03:31:30.046Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-17191/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-17191/runs/12 FAILURE 257558
[2020-04-30T03:31:30.597Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-17191/runs/12/steps/?limit=10000 -o steps-info.json
[2020-04-30T03:31:30.847Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-17191/runs/12/tests/?status=FAILED -o tests-errors.json
[2020-04-30T03:31:30.847Z] jq: error (at tests-errors.json:4): Cannot index string with string "_links"
[2020-04-30T03:31:30.847Z] jq: error (at tests-errors.json:4): Cannot index string with string "_class"
[2020-04-30T03:31:30.847Z] jq: error (at tests-errors.json:4): Cannot index string with string "state"
[2020-04-30T03:31:30.847Z] jq: error (at tests-errors.json:4): Cannot index string with string "hasStdLog"

Copy link
Contributor

@ycombinator ycombinator left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks for the contribution, @newly12!

@ycombinator
Copy link
Contributor

CI failures are unrelated. Merging.

@ycombinator ycombinator merged commit cd53df2 into elastic:master Apr 30, 2020
@newly12 newly12 deleted the dissect_supports_fixed_length_extraction branch May 1, 2020 00:11
ycombinator pushed a commit to ycombinator/beats that referenced this pull request May 5, 2020
Signed-off-by: Peter Deng <yundeng@ebay.com>
ycombinator added a commit that referenced this pull request May 6, 2020
Signed-off-by: Peter Deng <yundeng@ebay.com>

Co-authored-by: Peter Deng <newly.deng@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
libbeat :Processors Team:Services (Deprecated) Label for the former Integrations-Services team v7.8.0 v8.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support Fixed length extraction
5 participants