Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[system] Make event.original optional for application, security, and system ata streams #990

Merged
merged 1 commit into from
May 17, 2021

Conversation

marc-gr
Copy link
Contributor

@marc-gr marc-gr commented May 14, 2021

What does this PR do?

Makes event.original optional for application, security, and system data streams.

NOTE: In this case, event.original is already present from the winlog and httpjson inputs.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.

Related issues

Screenshots

image

image

@marc-gr marc-gr added enhancement New feature or request Team:Integrations Label for the Integrations team Team:Security-External Integrations labels May 14, 2021
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link

Pinging @elastic/integrations (Team:Integrations)

@marc-gr marc-gr changed the title [system] Make event.original optional for application, security, and system da… [system] Make event.original optional for application, security, and system ata streams May 14, 2021
@marc-gr marc-gr mentioned this pull request May 14, 2021
43 tasks
@elasticmachine
Copy link

elasticmachine commented May 14, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: Pull request #990 updated

  • Start Time: 2021-05-14T11:05:55.462+0000

  • Duration: 10 min 17 sec

  • Commit: a57ef2b

Test stats 🧪

Test Results
Failed 0
Passed 264
Skipped 0
Total 264

Trends 🧪

Image of Build Times

Image of Tests

@djptek
Copy link
Contributor

djptek commented May 14, 2021

Hi @marc-gr we have an RFC open to Deprecate log.original since in the majority of cases that field could equally be captured as event.original

From a quick grep it looks like event.original has more weight in integrations

% grep -Rw "log.original" ~/git/integrations/packages | wc
     135    3164   32774
% grep -Rw "event.original" ~/git/integrations/packages | wc
     263    2027   41656

I just wanted to check in, in case you might intend to rely on log.original as a result of this PR

@marc-gr
Copy link
Contributor Author

marc-gr commented May 14, 2021

hey @djptek!

This is part of an effort to be consistent about the way we deal with event.original in general, and the intent is to do not add it by default but have a toggle in all packages to let users enable it at will (#777).

Hope it makes sense 😄

@djptek
Copy link
Contributor

djptek commented May 14, 2021

Thanks @marc-gr makes a lot of sense saving resource, I just wanted to check that users would not opt out of event.original on the expectation that they could recover the data from log.original at some point in the future 👍

Copy link
Member

@P1llus P1llus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@marc-gr marc-gr merged commit 54d06dd into elastic:master May 17, 2021
@marc-gr marc-gr deleted the security-eventoriginal branch May 17, 2021 13:50
james-elastic pushed a commit to james-elastic/integrations that referenced this pull request Jun 30, 2021
eyalkraft pushed a commit to build-security/integrations that referenced this pull request Mar 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request Team:Integrations Label for the Integrations team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants