Merge branch 'master' into osquery/result_type_translation

elastic · Apr 14, 2021 · 0404152 · 0404152
2 parents 4c375a2 + 910156d
commit 0404152
Show file tree

Hide file tree

Showing 39 changed files with 418 additions and 40 deletions.
diff --git a/.ci/packer_cache.sh b/.ci/packer_cache.sh
@@ -21,13 +21,8 @@ source ./dev-tools/common.bash
 # couchbase:4.5.1
 # debian:latest
 # debian:stretch
-# docker.elastic.co/beats-dev/fpm:1.11.0
 # docker.elastic.co/beats/metricbeat:6.5.4
 # docker.elastic.co/beats/metricbeat:7.2.0
-# docker.elastic.co/elasticsearch/elasticsearch:7.2.0
-# docker.elastic.co/kibana/kibana:7.2.0
-# docker.elastic.co/logstash/logstash:7.2.0
-# docker.elastic.co/observability-ci/database-instantclient:12.2.0.1
 # envoyproxy/envoy:v1.7.0
 # exekias/localkube-image
 # haproxy:1.8
@@ -59,20 +54,28 @@ get_go_version
 
 DOCKER_IMAGES="docker.elastic.co/observability-ci/database-instantclient:12.2.0.1
 docker.elastic.co/observability-ci/database-enterprise:12.2.0.1
+docker.elastic.co/beats-dev/fpm:1.11.0
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-arm
+docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-base-arm-debian9
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-darwin
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main-debian7
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main-debian8
+docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main-debian9
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-mips
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-ppc
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-s390x
+docker.elastic.co/elasticsearch/elasticsearch:8.0.0-SNAPSHOT
+docker.elastic.co/kibana/kibana:8.0.0-SNAPSHOT
+docker.elastic.co/logstash/logstash:8.0.0-SNAPSHOT
 golang:${GO_VERSION}
+golang:1.14.12-stretch
+centos:7
 "
 if [ -x "$(command -v docker)" ]; then
   for image in ${DOCKER_IMAGES}
   do
-  (retry 2 docker pull ${image}) || echo "Error pulling ${image} Docker image, we continue"
+    (retry 2 docker pull ${image}) || echo "Error pulling ${image} Docker image. Continuing."
   done
 
   docker tag \
@@ -82,5 +85,5 @@ if [ -x "$(command -v docker)" ]; then
   docker tag \
     docker.elastic.co/observability-ci/database-enterprise:12.2.0.1 \
     store/oracle/database-enterprise:12.2.0.1 \
-    || echo "Error setting the Oracle Dtabase tag"
+    || echo "Error setting the Oracle Database tag"
 fi
diff --git a/.mergify.yml b/.mergify.yml
@@ -10,6 +10,8 @@ pull_request_rules:
           - "{{ author }}"
         branches:
           - "7.x"
+        labels:
+          - "backport"
   - name: backport patches to 7.12 branch
     conditions:
       - merged
@@ -21,6 +23,8 @@ pull_request_rules:
           - "{{ author }}"
         branches:
           - "7.12"
+        labels:
+          - "backport"
   - name: backport patches to 7.11 branch
     conditions:
       - merged
@@ -32,6 +36,8 @@ pull_request_rules:
           - "{{ author }}"
         branches:
           - "7.11"
+        labels:
+          - "backport"
   - name: ask to resolve conflict
     conditions:
       - conflict

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -607,6 +607,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add `wineventlog` schema to `decode_xml` processor. {issue}23910[23910] {pull}24726[24726]
 - Add new ECS 1.9 field `cloud.service.name` to `add_cloud_metadata` processor. {pull}24993[24993]
 - Libbeat: report queue capacity, output batch size, and output client count to monitoring. {pull}24700[24700]
+- Add kubernetes.pod.ip field in kubernetes metadata. {pull}25037[25037]
 
 *Auditbeat*
 
@@ -998,6 +999,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add additional event categorization for security and sysmon modules. {pull}22988[22988]
 - Add dns.question.subdomain fields for sysmon DNS events. {pull}22999[22999]
 - Add dns.question.top_level_domain fields for sysmon DNS events. {pull}23046[23046]
+- Add support for sysmon v13 events 24 and 25. {issue}24217[24217] {pull}24945[24945]
 
 *Elastic Log Driver*
 

diff --git a/auditbeat/docs/fields.asciidoc b/auditbeat/docs/fields.asciidoc
@@ -12397,6 +12397,16 @@ type: keyword
 
 --
 
+*`kubernetes.pod.ip`*::
++
+--
+Kubernetes Pod IP
+
+
+type: ip
+
+--
+
 *`kubernetes.namespace`*::
 +
 --

diff --git a/auditbeat/include/fields.go b/auditbeat/include/fields.go
diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
@@ -87194,6 +87194,16 @@ type: keyword
 
 --
 
+*`kubernetes.pod.ip`*::
++
+--
+Kubernetes Pod IP
+
+
+type: ip
+
+--
+
 *`kubernetes.namespace`*::
 +
 --

diff --git a/filebeat/include/fields.go b/filebeat/include/fields.go
diff --git a/heartbeat/docs/fields.asciidoc b/heartbeat/docs/fields.asciidoc
@@ -9979,6 +9979,16 @@ type: keyword
 
 --
 
+*`kubernetes.pod.ip`*::
++
+--
+Kubernetes Pod IP
+
+
+type: ip
+
+--
+
 *`kubernetes.namespace`*::
 +
 --

diff --git a/heartbeat/include/fields.go b/heartbeat/include/fields.go
diff --git a/journalbeat/docs/fields.asciidoc b/journalbeat/docs/fields.asciidoc
@@ -10324,6 +10324,16 @@ type: keyword
 
 --
 
+*`kubernetes.pod.ip`*::
++
+--
+Kubernetes Pod IP
+
+
+type: ip
+
+--
+
 *`kubernetes.namespace`*::
 +
 --

diff --git a/journalbeat/include/fields.go b/journalbeat/include/fields.go