From 92d08088a12a7ad44938bafe5a65b7fb2da15869 Mon Sep 17 00:00:00 2001 From: Marius Iversen Date: Fri, 16 Apr 2021 12:44:36 +0200 Subject: [PATCH] [Filebeat][httpjson] Change append transform to initiate new fields as a slice (#25074) (#25088) * changing the append processor to create a single value as list, not only if two or more values are added * removing mistake typo * add changelog entry (cherry picked from commit 2b11cf81c9eb26e18afef557ce5c6679a558c369) --- CHANGELOG.next.asciidoc | 2 ++ x-pack/filebeat/docs/inputs/input-httpjson.asciidoc | 2 +- .../input/httpjson/internal/v2/transform_append.go | 4 +++- .../httpjson/internal/v2/transform_append_test.go | 10 ++++++++++ 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index c8ef8f8c116..58e073a6f25 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -51,6 +51,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d - Rename `network.direction` values in crowdstrike/falcon to `ingress`/`egress`. {pull}23041[23041] - Rename `s3` input to `aws-s3` input. {pull}23469[23469] - Possible values for Netflow's locality fields (source.locality, destination.locality and flow.locality) are now `internal` and `external`, instead of `private` and `public`. {issue}24272[24272] {pull}24295[24295] +- Add User Agent Parser for Azure Sign In Logs Ingest Pipeline {pull}23201[23201] +- Changes filebeat httpjson input's append transform to create a list even with only a single value{pull}25074[25074] *Heartbeat* diff --git a/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc b/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc index c698c99e4cc..41108d4a192 100644 --- a/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc +++ b/x-pack/filebeat/docs/inputs/input-httpjson.asciidoc @@ -121,7 +121,7 @@ The access limitations are described in the corresponding configuration sections [float] ==== `append` -Appends a value to a list. If the field does not exist, the first entry will be a scalar value, and subsequent additions will convert the value to a list. +Appends a value to an array. If the field does not exist, the first entry will create a new array. If the field exists, the value is appended to the existing field and converted to a list. ["source","yaml",subs="attributes"] ---- diff --git a/x-pack/filebeat/input/httpjson/internal/v2/transform_append.go b/x-pack/filebeat/input/httpjson/internal/v2/transform_append.go index f2561ecd55b..50163ab1938 100644 --- a/x-pack/filebeat/input/httpjson/internal/v2/transform_append.go +++ b/x-pack/filebeat/input/httpjson/internal/v2/transform_append.go @@ -125,7 +125,7 @@ func appendToCommonMap(m common.MapStr, key, val string) error { if val == "" { return nil } - var value interface{} = val + var value interface{} if found, _ := m.HasKey(key); found { prev, _ := m.GetValue(key) switch t := prev.(type) { @@ -137,6 +137,8 @@ func appendToCommonMap(m common.MapStr, key, val string) error { value = []interface{}{prev, val} } + } else { + value = []interface{}{val} } if _, err := m.Put(key, value); err != nil { return err diff --git a/x-pack/filebeat/input/httpjson/internal/v2/transform_append_test.go b/x-pack/filebeat/input/httpjson/internal/v2/transform_append_test.go index 12b49af4395..73cb3e78026 100644 --- a/x-pack/filebeat/input/httpjson/internal/v2/transform_append_test.go +++ b/x-pack/filebeat/input/httpjson/internal/v2/transform_append_test.go @@ -147,6 +147,16 @@ func TestAppendFunctions(t *testing.T) { expectedTr: transformable{"body": common.MapStr{"a_key": []interface{}{"a_value", "another_value"}}}, expectedErr: nil, }, + { + name: "appendBodyWithSingleValue", + tfunc: appendBody, + paramCtx: &transformContext{}, + paramTr: transformable{"body": common.MapStr{}}, + paramKey: "a_key", + paramVal: "a_value", + expectedTr: transformable{"body": common.MapStr{"a_key": []interface{}{"a_value"}}}, + expectedErr: nil, + }, { name: "appendHeader", tfunc: appendHeader,