Skip to content

journald: add missing source.ip and host.ip ECS fields - #12166

Merged
mauri870 merged 0 commit into
elastic:mainfrom
mauri870:journald-source-host-ip
Dec 30, 2024
Merged

journald: add missing source.ip and host.ip ECS fields#12166
mauri870 merged 0 commit into
elastic:mainfrom
mauri870:journald-source-host-ip

Conversation

@mauri870

@mauri870 mauri870 commented Dec 19, 2024

Copy link
Copy Markdown
Member

Proposed commit message

This commit adds the missing ECS mappings for source.ip and host.ip. Since these fields were not mapped, they defaulted to keyword in logs from journald, causing conflicts in the data view.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test

Maybe there is a faster way, but what I did is the following:

  • Deploy a 8.12.1 cloud stack
  • Enroll an agent
  • Install the journald integration in the agent policy
  • In Discover, visualize the host.ip field, it shows as conflict (keyword, ip)
  • Package the integration and deploy to the existing cluster: elastic-package install --zip ./integrations/build/packages/journald-1.1.1.zip -v
  • Update the integration in the agent policy
  • In the new index after the rollover, confirm that mappings are correct (host.ip and source.ip are shown as ip)
  • Delete the old conflicting index
  • Check new data in Kibana, source.ip and host.ip are shown as ip and no conflict is reported.

Related issues

Screenshots

@mauri870 mauri870 added bug Something isn't working, use only for issues Team:Elastic-Agent-Data-Plane Agent Data Plane team [elastic/elastic-agent-data-plane] labels Dec 19, 2024
@mauri870 mauri870 self-assigned this Dec 19, 2024
@mauri870
mauri870 force-pushed the journald-source-host-ip branch from a240ccc to 3926b61 Compare December 19, 2024 13:54
@andrewkroh andrewkroh added bugfix Pull request that fixes a bug issue Integration:journald Custom Journald logs and removed bug Something isn't working, use only for issues labels Dec 19, 2024
@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

cc @mauri870

@mauri870
mauri870 marked this pull request as ready for review December 19, 2024 15:10
@mauri870
mauri870 requested a review from a team as a code owner December 19, 2024 15:10
@mauri870
mauri870 requested review from faec and leehinman December 19, 2024 15:10
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@mauri870
mauri870 merged commit c9d7480 into elastic:main Dec 30, 2024
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package journald - 1.1.1 containing this change is available at https://epr.elastic.co/package/journald/1.1.1/

harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
@mauri870
mauri870 deleted the journald-source-host-ip branch February 7, 2025 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix Pull request that fixes a bug issue Integration:journald Custom Journald logs Team:Elastic-Agent-Data-Plane Agent Data Plane team [elastic/elastic-agent-data-plane]

4 participants