Skip to content

Add kubernetes.audit.annotations.authorization_k8s_io/* fields #4203

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tetianakravchenko merged 2 commits into from
Sep 13, 2022
+15 −7
Merged

Add kubernetes.audit.annotations.authorization_k8s_io/* fields #4203

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d12ef1b
add kubernetes.audit.annotations.authorization_k8s_io/* fields
tetianakravchenko Sep 12, 2022
ebbdc92
update pr number
tetianakravchenko Sep 13, 2022
File filter

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/kubernetes/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.24.0"
changes:
- description: Add fields to audit logs data stream
type: enhancement
link: https://github.com/elastic/integrations/pull/4203
- version: "1.23.1"
changes:
- description: Add missing dimension fields
Expand Down
12 changes: 7 additions & 5 deletions packages/kubernetes/data_stream/audit_logs/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,8 +211,10 @@
- name: stageTimestamp
type: date
description: Time the request reached current audit stage
- name: annotations.*
type: object
object_type: text
object_type_mapping_type: "*"
description: Audit event annotations
- name: annotations
type: group
fields:
- name: authorization_k8s_io/decision
type: keyword
- name: authorization_k8s_io/reason
type: text
3 changes: 2 additions & 1 deletion packages/kubernetes/docs/audit-logs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,8 @@ An example event for `audit` looks as following:
| host.os.version | Operating system version as a raw string. | keyword |
| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword |
| input.type | Type of input. | keyword |
| kubernetes.audit.annotations.\* | Audit event annotations | object |
| kubernetes.audit.annotations.authorization_k8s_io/decision | | keyword |
| kubernetes.audit.annotations.authorization_k8s_io/reason | | text |
| kubernetes.audit.apiVersion | Audit event api version | keyword |
| kubernetes.audit.auditID | Unique audit ID, generated for each request | keyword |
| kubernetes.audit.impersonatedUser.extra.\* | Any additional information provided by the authenticator | object |
Expand Down
2 changes: 1 addition & 1 deletion packages/kubernetes/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 1.0.0
name: kubernetes
title: Kubernetes
version: 1.23.1
version: 1.24.0
license: basic
description: Collect logs and metrics from Kubernetes clusters with Elastic Agent.
type: integration
Expand Down