journald: add missing source.ip and host.ip ECS fields

packages/journald/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.1.1"
+  changes:
+    - description: Add missing source.ip and host.ip ECS fields.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/12166
 - version: "1.1.0"
   changes:
     - description: Upgrade journald to ECS 8.10.

packages/journald/docs/README.md

@@ -144,6 +144,7 @@ An example event looks as follows:
 | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword |
 | host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword |
 | host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword |
+| host.ip | Host ip address. | ip |
 | input.type |  | keyword |
 | journald.audit.login_uid | The login UID of the process the journal entry originates from, as maintained by the kernel audit subsystem. | long |
 | journald.audit.session | The session of the process the journal entry originates from, as maintained by the kernel audit subsystem. | keyword |
@@ -189,6 +190,7 @@ An example event looks as follows:
 | process.command_line.text | Multi-field of `process.command_line`. | match_only_text |
 | process.pid | Process id. | long |
 | process.thread.capabilities.effective | This is the set of capabilities used by the kernel to perform permission checks for the thread. | keyword |
+| source.ip | IP address of the source. | ip |
 | systemd.cgroup | The control group path in the systemd hierarchy. | keyword |
 | systemd.invocation_id | The invocation ID for the runtime cycle of the unit the message was generated in, as available to processes of the unit in $INVOCATION_ID. | keyword |
 | systemd.owner_uid | The owner UID of the systemd user unit or systemd session (if any) of the process the journal entry originates from. | long |

packages/journald/fields/ecs.yml

@@ -8,6 +8,8 @@
   external: ecs
 - name: host.id
   external: ecs
+- name: host.ip
+  external: ecs
 - name: log.syslog.facility.code
   external: ecs
 - name: log.syslog.priority
@@ -32,6 +34,8 @@
   external: ecs
 - name: process.pid
   external: ecs
+- name: source.ip
+  external: ecs
 - name: tags
   external: ecs
 - name: user.group.id

packages/journald/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 2.6.0
 name: journald
 title: "Custom Journald logs"
-version: 1.1.0
+version: 1.1.1
 description: Collect logs from journald with Elastic Agent.
 type: input
 categories: