{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/ecs/issues/504","repository_url":"https://api.github.com/repos/elastic/ecs","labels_url":"https://api.github.com/repos/elastic/ecs/issues/504/labels{/name}","comments_url":"https://api.github.com/repos/elastic/ecs/issues/504/comments","events_url":"https://api.github.com/repos/elastic/ecs/issues/504/events","html_url":"https://github.com/elastic/ecs/issues/504","id":471211204,"node_id":"MDU6SXNzdWU0NzEyMTEyMDQ=","number":504,"title":"Mapping Cloudflare Logs onto ECS","user":{"login":"aleph-zero","id":452273,"node_id":"MDQ6VXNlcjQ1MjI3Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/452273?v=4","gravatar_id":"","url":"https://api.github.com/users/aleph-zero","html_url":"https://github.com/aleph-zero","followers_url":"https://api.github.com/users/aleph-zero/followers","following_url":"https://api.github.com/users/aleph-zero/following{/other_user}","gists_url":"https://api.github.com/users/aleph-zero/gists{/gist_id}","starred_url":"https://api.github.com/users/aleph-zero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aleph-zero/subscriptions","organizations_url":"https://api.github.com/users/aleph-zero/orgs","repos_url":"https://api.github.com/users/aleph-zero/repos","events_url":"https://api.github.com/users/aleph-zero/events{/privacy}","received_events_url":"https://api.github.com/users/aleph-zero/received_events","type":"User","site_admin":false},"labels":[{"id":943218373,"node_id":"MDU6TGFiZWw5NDMyMTgzNzM=","url":"https://api.github.com/repos/elastic/ecs/labels/help%20wanted","name":"help wanted","color":"008672","default":true}],"state":"open","locked":false,"assignee":{"login":"aleph-zero","id":452273,"node_id":"MDQ6VXNlcjQ1MjI3Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/452273?v=4","gravatar_id":"","url":"https://api.github.com/users/aleph-zero","html_url":"https://github.com/aleph-zero","followers_url":"https://api.github.com/users/aleph-zero/followers","following_url":"https://api.github.com/users/aleph-zero/following{/other_user}","gists_url":"https://api.github.com/users/aleph-zero/gists{/gist_id}","starred_url":"https://api.github.com/users/aleph-zero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aleph-zero/subscriptions","organizations_url":"https://api.github.com/users/aleph-zero/orgs","repos_url":"https://api.github.com/users/aleph-zero/repos","events_url":"https://api.github.com/users/aleph-zero/events{/privacy}","received_events_url":"https://api.github.com/users/aleph-zero/received_events","type":"User","site_admin":false},"assignees":[{"login":"aleph-zero","id":452273,"node_id":"MDQ6VXNlcjQ1MjI3Mw==","avatar_url":"https://avatars2.githubusercontent.com/u/452273?v=4","gravatar_id":"","url":"https://api.github.com/users/aleph-zero","html_url":"https://github.com/aleph-zero","followers_url":"https://api.github.com/users/aleph-zero/followers","following_url":"https://api.github.com/users/aleph-zero/following{/other_user}","gists_url":"https://api.github.com/users/aleph-zero/gists{/gist_id}","starred_url":"https://api.github.com/users/aleph-zero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aleph-zero/subscriptions","organizations_url":"https://api.github.com/users/aleph-zero/orgs","repos_url":"https://api.github.com/users/aleph-zero/repos","events_url":"https://api.github.com/users/aleph-zero/events{/privacy}","received_events_url":"https://api.github.com/users/aleph-zero/received_events","type":"User","site_admin":false}],"milestone":null,"comments":11,"created_at":"2019-07-22T17:25:41Z","updated_at":"2019-08-22T18:44:48Z","closed_at":null,"author_association":"NONE","body":"I'm working on mapping Cloudflare logs onto ECS. The official Cloudflare documentation on the fields and their descriptions:\r\n\r\n- Fields: https://developers.cloudflare.com/logs/logpull-api/requesting-logs/#fields\r\n- Description: https://developers.cloudflare.com/logs/reference/glossary/\r\n\r\nMy first pass is in this Excel sheet: [Cloudflare-ECS.xlsx](https://github.com/elastic/ecs/files/3418541/Cloudflare-ECS.xlsx)\r\n\r\n@MikePaquette and @webmat can you help me by sanity checking what I've done so far?\r\n"},"comment":{"url":"https://api.github.com/repos/elastic/ecs/issues/comments/524028793","html_url":"https://github.com/elastic/ecs/issues/504#issuecomment-524028793","issue_url":"https://api.github.com/repos/elastic/ecs/issues/504","id":524028793,"node_id":"MDEyOklzc3VlQ29tbWVudDUyNDAyODc5Mw==","user":{"login":"webmat","id":2300,"node_id":"MDQ6VXNlcjIzMDA=","avatar_url":"https://avatars1.githubusercontent.com/u/2300?v=4","gravatar_id":"","url":"https://api.github.com/users/webmat","html_url":"https://github.com/webmat","followers_url":"https://api.github.com/users/webmat/followers","following_url":"https://api.github.com/users/webmat/following{/other_user}","gists_url":"https://api.github.com/users/webmat/gists{/gist_id}","starred_url":"https://api.github.com/users/webmat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/webmat/subscriptions","organizations_url":"https://api.github.com/users/webmat/orgs","repos_url":"https://api.github.com/users/webmat/repos","events_url":"https://api.github.com/users/webmat/events{/privacy}","received_events_url":"https://api.github.com/users/webmat/received_events","type":"User","site_admin":false},"created_at":"2019-08-22T18:44:48Z","updated_at":"2019-08-22T18:44:48Z","author_association":"CONTRIBUTOR","body":"I understood `observer.*` to be more of a device operating inside one's network, such as a network monitoring tool or a firewall at the edge. So Cloudflare being a massive distributed service didn't seem to fit for observer.\r\n\r\nBut since all traffic for a given service is passing through Cloudflare, I suppose we can indeed use `observer.*`.\r\n\r\nIt's important that both ends of the network connection remain the \"real\" client IP and the origin server, however. So don't touch those, other than copying to client/server in addition to source/destination, as @MikePaquette suggested.\r\n\r\nSo I'm thinking:\r\n\r\n- EdgeServerIP => `observer.ip`\r\n- hard code `observer.vendor` to \"cloudflare\"\r\n- Keep `event.dataset` as \"cloudflare.log\"\r\n- hard code `observer.type` to \"proxy\", as Mike suggests\r\n\r\nI haven't seen any other obvious mappings for observer, including `observer.hostname`."}}
{"actor":{"display_login":"webmat"}}