From 3926b61f73d178f93002db23838760f222eca54d Mon Sep 17 00:00:00 2001 From: Mauri de Souza Meneguzzo Date: Thu, 19 Dec 2024 10:48:49 -0300 Subject: [PATCH] journald: add missing source.ip and host.ip ECS fields --- packages/journald/changelog.yml | 5 +++++ packages/journald/docs/README.md | 2 ++ packages/journald/fields/ecs.yml | 4 ++++ packages/journald/manifest.yml | 2 +- 4 files changed, 12 insertions(+), 1 deletion(-) diff --git a/packages/journald/changelog.yml b/packages/journald/changelog.yml index 80880e642b2..11212ff600d 100644 --- a/packages/journald/changelog.yml +++ b/packages/journald/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.1.1" + changes: + - description: Add missing source.ip and host.ip ECS fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/12166 - version: "1.1.0" changes: - description: Upgrade journald to ECS 8.10. diff --git a/packages/journald/docs/README.md b/packages/journald/docs/README.md index 96fe8c5c6ed..09ab19d5979 100644 --- a/packages/journald/docs/README.md +++ b/packages/journald/docs/README.md @@ -144,6 +144,7 @@ An example event looks as follows: | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword | | host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip address. | ip | | input.type | | keyword | | journald.audit.login_uid | The login UID of the process the journal entry originates from, as maintained by the kernel audit subsystem. | long | | journald.audit.session | The session of the process the journal entry originates from, as maintained by the kernel audit subsystem. | keyword | @@ -189,6 +190,7 @@ An example event looks as follows: | process.command_line.text | Multi-field of `process.command_line`. | match_only_text | | process.pid | Process id. | long | | process.thread.capabilities.effective | This is the set of capabilities used by the kernel to perform permission checks for the thread. | keyword | +| source.ip | IP address of the source. | ip | | systemd.cgroup | The control group path in the systemd hierarchy. | keyword | | systemd.invocation_id | The invocation ID for the runtime cycle of the unit the message was generated in, as available to processes of the unit in $INVOCATION_ID. | keyword | | systemd.owner_uid | The owner UID of the systemd user unit or systemd session (if any) of the process the journal entry originates from. | long | diff --git a/packages/journald/fields/ecs.yml b/packages/journald/fields/ecs.yml index 474517000dc..ae7e7a8919a 100644 --- a/packages/journald/fields/ecs.yml +++ b/packages/journald/fields/ecs.yml @@ -8,6 +8,8 @@ external: ecs - name: host.id external: ecs +- name: host.ip + external: ecs - name: log.syslog.facility.code external: ecs - name: log.syslog.priority @@ -32,6 +34,8 @@ external: ecs - name: process.pid external: ecs +- name: source.ip + external: ecs - name: tags external: ecs - name: user.group.id diff --git a/packages/journald/manifest.yml b/packages/journald/manifest.yml index 67100d62e22..8e7f8519c91 100644 --- a/packages/journald/manifest.yml +++ b/packages/journald/manifest.yml @@ -1,7 +1,7 @@ format_version: 2.6.0 name: journald title: "Custom Journald logs" -version: 1.1.0 +version: 1.1.1 description: Collect logs from journald with Elastic Agent. type: input categories: