{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/beats/issues/8153","repository_url":"https://api.github.com/repos/elastic/beats","labels_url":"https://api.github.com/repos/elastic/beats/issues/8153/labels{/name}","comments_url":"https://api.github.com/repos/elastic/beats/issues/8153/comments","events_url":"https://api.github.com/repos/elastic/beats/issues/8153/events","html_url":"https://github.com/elastic/beats/issues/8153","id":355346043,"node_id":"MDU6SXNzdWUzNTUzNDYwNDM=","number":8153,"title":"[Filebeat][meta] Add Suricata module","user":{"login":"andrewkroh","id":4565752,"node_id":"MDQ6VXNlcjQ1NjU3NTI=","avatar_url":"https://avatars2.githubusercontent.com/u/4565752?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"labels":[{"id":294278645,"node_id":"MDU6TGFiZWwyOTQyNzg2NDU=","url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000","default":false},{"id":78874874,"node_id":"MDU6TGFiZWw3ODg3NDg3NA==","url":"https://api.github.com/repos/elastic/beats/labels/enhancement","name":"enhancement","color":"fbca04","default":true},{"id":296601926,"node_id":"MDU6TGFiZWwyOTY2MDE5MjY=","url":"https://api.github.com/repos/elastic/beats/labels/meta","name":"meta","color":"ff8c00","default":false},{"id":219536313,"node_id":"MDU6TGFiZWwyMTk1MzYzMTM=","url":"https://api.github.com/repos/elastic/beats/labels/module","name":"module","color":"008000","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-08-29T21:47:48Z","updated_at":"2018-09-03T12:43:56Z","closed_at":null,"author_association":"MEMBER","body":"This is the meta issue to track the task of adding a new Filebeat module that reads the [Suricata EVE JSON output](https://suricata.readthedocs.io/en/latest/output/eve/eve-json-format.html).\r\n\r\n- [ ] Add ECS fields to fields.yml.\r\n  - A convenient way to import this would be nice (like simply copying a fields-ecs.yml file to `_meta/`).\r\n- [ ] For Filebeat 7.0 rename `source` to `?` in accordance with ECS.\r\n  - According to the [ECS logging use case](https://github.com/elastic/ecs/blob/973c93f5a241675c742790ffbf1097e24a6b835e/use-cases/logging.md) this field should be `source.path`. (Is this correct?)\r\n- [ ] Package X-Pack modules with the Elastic licensed Filebeat version.\r\n- [ ] Add and test the Suricata module.\r\n  - https://github.com/elastic/beats/pull/8089\r\n  - Add a way to verify from Go that a JSON document's fields are contained in fields.yml. We will be validating the document after it has gone through the Ingest Node pipeline and is queried from ES.\r\n  - Document that the module is only included in Elastic licensed packages.\r\n- [ ] Write documentation for the module that explains how to set it up and use it.\r\n  - [ ] Define tested Suricata versions.\r\n- [ ] Backport module to 6.x and work-around the conflict of the ECS `source.ip` with the Filebeat 6.x `source` field.\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/beats/issues/comments/418104588","html_url":"https://github.com/elastic/beats/issues/8153#issuecomment-418104588","issue_url":"https://api.github.com/repos/elastic/beats/issues/8153","id":418104588,"node_id":"MDEyOklzc3VlQ29tbWVudDQxODEwNDU4OA==","user":{"login":"ruflin","id":244900,"node_id":"MDQ6VXNlcjI0NDkwMA==","avatar_url":"https://avatars3.githubusercontent.com/u/244900?v=4","gravatar_id":"","url":"https://api.github.com/users/ruflin","html_url":"https://github.com/ruflin","followers_url":"https://api.github.com/users/ruflin/followers","following_url":"https://api.github.com/users/ruflin/following{/other_user}","gists_url":"https://api.github.com/users/ruflin/gists{/gist_id}","starred_url":"https://api.github.com/users/ruflin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ruflin/subscriptions","organizations_url":"https://api.github.com/users/ruflin/orgs","repos_url":"https://api.github.com/users/ruflin/repos","events_url":"https://api.github.com/users/ruflin/events{/privacy}","received_events_url":"https://api.github.com/users/ruflin/received_events","type":"User","site_admin":false},"created_at":"2018-09-03T12:43:56Z","updated_at":"2018-09-03T12:43:56Z","author_association":"COLLABORATOR","body":"Update: Looks like I missed the first link from @simitt which contains the code on the apm-server side to check the fields: https://github.com/elastic/apm-server/blob/e0e849c3e94042db07573f0c1e6684439f29b88e/tests/fields.go#L46"}}
{"actor":{"display_login":"ruflin"}}