{"action":"created","comment":{"url":"https://api.github.com/repos/elastic/beats/pulls/comments/241763522","pull_request_review_id":185119921,"id":241763522,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDI0MTc2MzUyMg==","diff_hunk":"@@ -0,0 +1,64 @@\n+{\n+    \"description\": \"Pipeline for parsing Google Santa logs.\",\n+    \"processors\": [\n+        {\n+            \"grok\": {\n+                \"field\": \"message\",\n+                \"patterns\": [\n+                    \"\\\\[%{TIMESTAMP_ISO8601:process.start}\\\\] I santad: action=%{NOT_SEPARATOR:santa.action}\\\\|decision=%{NOT_SEPARATOR:santa.decision}\\\\|reason=%{NOT_SEPARATOR:santa.reason}\\\\|sha256=%{NOT_SEPARATOR:hash.sha256}\\\\|path=%{NOT_SEPARATOR:process.executable}(\\\\|args=%{NOT_SEPARATOR:process.args})?(\\\\|cert_sha256=%{NOT_SEPARATOR:certificate.sha256})?(\\\\|cert_cn=%{NOT_SEPARATOR:certificate.common_name})?\\\\|pid=%{NUMBER:process.pid}\\\\|ppid=%{NUMBER:process.ppid}\\\\|uid=%{NUMBER:user.id}\\\\|user=%{NOT_SEPARATOR:user.name}\\\\|gid=%{NUMBER:group.id}\\\\|group=%{NOT_SEPARATOR:group.name}\\\\|mode=%{WORD:santa.mode}\"","path":"filebeat/module/santa/log/ingest/pipeline.json","position":8,"original_position":8,"commit_id":"9f3283ca20e828d33c1e699fdfaa0242ae809636","original_commit_id":"9f3283ca20e828d33c1e699fdfaa0242ae809636","user":{"login":"webmat","id":2300,"node_id":"MDQ6VXNlcjIzMDA=","avatar_url":"https://avatars1.githubusercontent.com/u/2300?v=4","gravatar_id":"","url":"https://api.github.com/users/webmat","html_url":"https://github.com/webmat","followers_url":"https://api.github.com/users/webmat/followers","following_url":"https://api.github.com/users/webmat/following{/other_user}","gists_url":"https://api.github.com/users/webmat/gists{/gist_id}","starred_url":"https://api.github.com/users/webmat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/webmat/subscriptions","organizations_url":"https://api.github.com/users/webmat/orgs","repos_url":"https://api.github.com/users/webmat/repos","events_url":"https://api.github.com/users/webmat/events{/privacy}","received_events_url":"https://api.github.com/users/webmat/received_events","type":"User","site_admin":false},"body":"Suggestion to simplify the pipeline, and remove the need for a few `convert` blocks below.\r\n\r\nNotice that I'm also converting the `user.id` and `group.id` in this suggestion.","created_at":"2018-12-14T14:02:29Z","updated_at":"2018-12-14T14:10:01Z","html_url":"https://github.com/elastic/beats/pull/9540#discussion_r241763522","pull_request_url":"https://api.github.com/repos/elastic/beats/pulls/9540","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments/241763522"},"html":{"href":"https://github.com/elastic/beats/pull/9540#discussion_r241763522"},"pull_request":{"href":"https://api.github.com/repos/elastic/beats/pulls/9540"}},"in_reply_to_id":241763204},"pull_request":{"url":"https://api.github.com/repos/elastic/beats/pulls/9540","id":238631018,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM4NjMxMDE4","html_url":"https://github.com/elastic/beats/pull/9540","diff_url":"https://github.com/elastic/beats/pull/9540.diff","patch_url":"https://github.com/elastic/beats/pull/9540.patch","issue_url":"https://api.github.com/repos/elastic/beats/issues/9540","number":9540,"state":"open","locked":false,"title":"Add Filebeat module for monitoring Santa","user":{"login":"andrewkroh","id":4565752,"node_id":"MDQ6VXNlcjQ1NjU3NTI=","avatar_url":"https://avatars2.githubusercontent.com/u/4565752?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"body":"This adds a Filebeat module for monitoring and parsing the log file generated\r\nby the Google Santa, a process monitoring tool for MacOS. This module includes\r\nan overview dashboard.\r\n\r\nhttps://github.com/google/santa\r\n\r\n![filebeat-santa-log-overview-dashboard](https://user-images.githubusercontent.com/4565752/49988875-428dca80-ff2d-11e8-9142-87589467e113.png)\r\n","created_at":"2018-12-14T07:18:11Z","updated_at":"2018-12-14T14:10:01Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e623565b56684ee1a2b0458acf23b58a6c08f87d","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":294278645,"node_id":"MDU6TGFiZWwyOTQyNzg2NDU=","url":"https://api.github.com/repos/elastic/beats/labels/Filebeat","name":"Filebeat","color":"008000","default":false},{"id":219536313,"node_id":"MDU6TGFiZWwyMTk1MzYzMTM=","url":"https://api.github.com/repos/elastic/beats/labels/module","name":"module","color":"008000","default":false},{"id":228068770,"node_id":"MDU6TGFiZWwyMjgwNjg3NzA=","url":"https://api.github.com/repos/elastic/beats/labels/review","name":"review","color":"207de5","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/elastic/beats/pulls/9540/commits","review_comments_url":"https://api.github.com/repos/elastic/beats/pulls/9540/comments","review_comment_url":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}","comments_url":"https://api.github.com/repos/elastic/beats/issues/9540/comments","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/9f3283ca20e828d33c1e699fdfaa0242ae809636","head":{"label":"andrewkroh:feature/fb/santa-module","ref":"feature/fb/santa-module","sha":"9f3283ca20e828d33c1e699fdfaa0242ae809636","user":{"login":"andrewkroh","id":4565752,"node_id":"MDQ6VXNlcjQ1NjU3NTI=","avatar_url":"https://avatars2.githubusercontent.com/u/4565752?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"repo":{"id":38412372,"node_id":"MDEwOlJlcG9zaXRvcnkzODQxMjM3Mg==","name":"beats","full_name":"andrewkroh/beats","private":false,"owner":{"login":"andrewkroh","id":4565752,"node_id":"MDQ6VXNlcjQ1NjU3NTI=","avatar_url":"https://avatars2.githubusercontent.com/u/4565752?v=4","gravatar_id":"","url":"https://api.github.com/users/andrewkroh","html_url":"https://github.com/andrewkroh","followers_url":"https://api.github.com/users/andrewkroh/followers","following_url":"https://api.github.com/users/andrewkroh/following{/other_user}","gists_url":"https://api.github.com/users/andrewkroh/gists{/gist_id}","starred_url":"https://api.github.com/users/andrewkroh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andrewkroh/subscriptions","organizations_url":"https://api.github.com/users/andrewkroh/orgs","repos_url":"https://api.github.com/users/andrewkroh/repos","events_url":"https://api.github.com/users/andrewkroh/events{/privacy}","received_events_url":"https://api.github.com/users/andrewkroh/received_events","type":"User","site_admin":false},"html_url":"https://github.com/andrewkroh/beats","description":"Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":true,"url":"https://api.github.com/repos/andrewkroh/beats","forks_url":"https://api.github.com/repos/andrewkroh/beats/forks","keys_url":"https://api.github.com/repos/andrewkroh/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/andrewkroh/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/andrewkroh/beats/teams","hooks_url":"https://api.github.com/repos/andrewkroh/beats/hooks","issue_events_url":"https://api.github.com/repos/andrewkroh/beats/issues/events{/number}","events_url":"https://api.github.com/repos/andrewkroh/beats/events","assignees_url":"https://api.github.com/repos/andrewkroh/beats/assignees{/user}","branches_url":"https://api.github.com/repos/andrewkroh/beats/branches{/branch}","tags_url":"https://api.github.com/repos/andrewkroh/beats/tags","blobs_url":"https://api.github.com/repos/andrewkroh/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/andrewkroh/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/andrewkroh/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/andrewkroh/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/andrewkroh/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/andrewkroh/beats/languages","stargazers_url":"https://api.github.com/repos/andrewkroh/beats/stargazers","contributors_url":"https://api.github.com/repos/andrewkroh/beats/contributors","subscribers_url":"https://api.github.com/repos/andrewkroh/beats/subscribers","subscription_url":"https://api.github.com/repos/andrewkroh/beats/subscription","commits_url":"https://api.github.com/repos/andrewkroh/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/andrewkroh/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/andrewkroh/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/andrewkroh/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/andrewkroh/beats/contents/{+path}","compare_url":"https://api.github.com/repos/andrewkroh/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/andrewkroh/beats/merges","archive_url":"https://api.github.com/repos/andrewkroh/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/andrewkroh/beats/downloads","issues_url":"https://api.github.com/repos/andrewkroh/beats/issues{/number}","pulls_url":"https://api.github.com/repos/andrewkroh/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/andrewkroh/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/andrewkroh/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/andrewkroh/beats/labels{/name}","releases_url":"https://api.github.com/repos/andrewkroh/beats/releases{/id}","deployments_url":"https://api.github.com/repos/andrewkroh/beats/deployments","created_at":"2015-07-02T05:03:11Z","updated_at":"2018-08-01T14:58:10Z","pushed_at":"2018-12-14T07:43:14Z","git_url":"git://github.com/andrewkroh/beats.git","ssh_url":"git@github.com:andrewkroh/beats.git","clone_url":"https://github.com/andrewkroh/beats.git","svn_url":"https://github.com/andrewkroh/beats","homepage":"https://www.elastic.co/products/beats","size":101262,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"elastic:master","ref":"master","sha":"c7daf89db5e70c3b3e655476260c7463ae1f6482","user":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"repo":{"id":16554739,"node_id":"MDEwOlJlcG9zaXRvcnkxNjU1NDczOQ==","name":"beats","full_name":"elastic/beats","private":false,"owner":{"login":"elastic","id":6764390,"node_id":"MDEyOk9yZ2FuaXphdGlvbjY3NjQzOTA=","avatar_url":"https://avatars0.githubusercontent.com/u/6764390?v=4","gravatar_id":"","url":"https://api.github.com/users/elastic","html_url":"https://github.com/elastic","followers_url":"https://api.github.com/users/elastic/followers","following_url":"https://api.github.com/users/elastic/following{/other_user}","gists_url":"https://api.github.com/users/elastic/gists{/gist_id}","starred_url":"https://api.github.com/users/elastic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/elastic/subscriptions","organizations_url":"https://api.github.com/users/elastic/orgs","repos_url":"https://api.github.com/users/elastic/repos","events_url":"https://api.github.com/users/elastic/events{/privacy}","received_events_url":"https://api.github.com/users/elastic/received_events","type":"Organization","site_admin":false},"html_url":"https://github.com/elastic/beats","description":":tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash ","fork":false,"url":"https://api.github.com/repos/elastic/beats","forks_url":"https://api.github.com/repos/elastic/beats/forks","keys_url":"https://api.github.com/repos/elastic/beats/keys{/key_id}","collaborators_url":"https://api.github.com/repos/elastic/beats/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/elastic/beats/teams","hooks_url":"https://api.github.com/repos/elastic/beats/hooks","issue_events_url":"https://api.github.com/repos/elastic/beats/issues/events{/number}","events_url":"https://api.github.com/repos/elastic/beats/events","assignees_url":"https://api.github.com/repos/elastic/beats/assignees{/user}","branches_url":"https://api.github.com/repos/elastic/beats/branches{/branch}","tags_url":"https://api.github.com/repos/elastic/beats/tags","blobs_url":"https://api.github.com/repos/elastic/beats/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/elastic/beats/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/elastic/beats/git/refs{/sha}","trees_url":"https://api.github.com/repos/elastic/beats/git/trees{/sha}","statuses_url":"https://api.github.com/repos/elastic/beats/statuses/{sha}","languages_url":"https://api.github.com/repos/elastic/beats/languages","stargazers_url":"https://api.github.com/repos/elastic/beats/stargazers","contributors_url":"https://api.github.com/repos/elastic/beats/contributors","subscribers_url":"https://api.github.com/repos/elastic/beats/subscribers","subscription_url":"https://api.github.com/repos/elastic/beats/subscription","commits_url":"https://api.github.com/repos/elastic/beats/commits{/sha}","git_commits_url":"https://api.github.com/repos/elastic/beats/git/commits{/sha}","comments_url":"https://api.github.com/repos/elastic/beats/comments{/number}","issue_comment_url":"https://api.github.com/repos/elastic/beats/issues/comments{/number}","contents_url":"https://api.github.com/repos/elastic/beats/contents/{+path}","compare_url":"https://api.github.com/repos/elastic/beats/compare/{base}...{head}","merges_url":"https://api.github.com/repos/elastic/beats/merges","archive_url":"https://api.github.com/repos/elastic/beats/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/elastic/beats/downloads","issues_url":"https://api.github.com/repos/elastic/beats/issues{/number}","pulls_url":"https://api.github.com/repos/elastic/beats/pulls{/number}","milestones_url":"https://api.github.com/repos/elastic/beats/milestones{/number}","notifications_url":"https://api.github.com/repos/elastic/beats/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/elastic/beats/labels{/name}","releases_url":"https://api.github.com/repos/elastic/beats/releases{/id}","deployments_url":"https://api.github.com/repos/elastic/beats/deployments","created_at":"2014-02-05T19:01:02Z","updated_at":"2018-12-14T13:50:13Z","pushed_at":"2018-12-14T14:07:29Z","git_url":"git://github.com/elastic/beats.git","ssh_url":"git@github.com:elastic/beats.git","clone_url":"https://github.com/elastic/beats.git","svn_url":"https://github.com/elastic/beats","homepage":"https://www.elastic.co/products/beats","size":111267,"stargazers_count":6560,"watchers_count":6560,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2095,"mirror_url":null,"archived":false,"open_issues_count":1122,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":2095,"open_issues":1122,"watchers":6560,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/elastic/beats/pulls/9540"},"html":{"href":"https://github.com/elastic/beats/pull/9540"},"issue":{"href":"https://api.github.com/repos/elastic/beats/issues/9540"},"comments":{"href":"https://api.github.com/repos/elastic/beats/issues/9540/comments"},"review_comments":{"href":"https://api.github.com/repos/elastic/beats/pulls/9540/comments"},"review_comment":{"href":"https://api.github.com/repos/elastic/beats/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/elastic/beats/pulls/9540/commits"},"statuses":{"href":"https://api.github.com/repos/elastic/beats/statuses/9f3283ca20e828d33c1e699fdfaa0242ae809636"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"webmat"}}