[SIEM][Filebeat] Suricata event duration incorrectly calculated.

[jamesspi]

• Version: 7.3.1
• Operating System: Centos 7
• Steps to Reproduce: Run Suricata Module with default Ingest pipeline.

{
  "timestamp": "2019-08-04T12:08:34.000385+0000",
  "flow_id": 1332577115159054,
  "event_type": "flow",
  "src_ip": "46.101.87.151",
  "src_port": 50632,
  "dest_ip": "67.207.67.3",
  "dest_port": 53,
  "proto": "UDP",
  "app_proto": "dns",
  "flow": {
    "pkts_toserver": 1,
    "pkts_toclient": 1,
    "bytes_toserver": 87,
    "bytes_toclient": 148,
    "start": "2019-08-04T12:03:33.899598+0000",
    "end": "2019-08-04T12:03:33.900653+0000",
    "age": 0,
    "state": "established",
    "reason": "timeout",
    "alerted": false
  }
}

Whilst using the SIEM app, I noticed that the Suricata flow duration was not correct. Instead of calculating flow.end - flow.start after discussing with @adriansr , it turns out that we set the following:

event.end = @timestamp , and then evt.duration=evt.end - evt.start

This does not provide a correct result for event duration, as we can see from an example raw suricate event above.

[elasticmachine]

Pinging @elastic/siem

[adriansr]

This was fixed in #13329 by @andrewkroh and will appear in 7.4.