Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat] netflow.* Fields Missing from Index Template #13768

Closed
andrewkroh opened this issue Sep 23, 2019 · 0 comments · Fixed by #13914
Closed

[Filebeat] netflow.* Fields Missing from Index Template #13768

andrewkroh opened this issue Sep 23, 2019 · 0 comments · Fixed by #13914
Labels
bug Filebeat Filebeat x-pack Issues and pull requests for X-Pack features.

Comments

@andrewkroh
Copy link
Member

None of the netflow.* fields are in the generated index template. This can be verified by running filebeat export template and looking for netflow.
@andrewkroh andrewkroh added bug Filebeat Filebeat x-pack Issues and pull requests for X-Pack features. labels Sep 23, 2019
adriansr added a commit to adriansr/beats that referenced this issue Oct 4, 2019
@adriansr
Field registry: Don't overwrite fields with same name
e754918 
When fields are registered (fields.go, autogenerated), they are grouped
by (Beatname, Name and Priority). Currently, if the same triplet is used
more than once, the previous asset is overwritten.

This is the case with Filebeat inputs and modules sharing the same name:

module/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

input/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

Also this introduces an inconsistence as the order of registration can
vary.

Fixes elastic#13768
@adriansr adriansr mentioned this issue Oct 4, 2019
Merged
adriansr added a commit that referenced this issue Oct 14, 2019
@adriansr
Field registry: Don't overwrite fields with same name (#13914)
4be5efe 
When fields are registered (fields.go, autogenerated), they are grouped
by (Beatname, Name and Priority). Currently, if the same triplet is used
more than once, the previous asset is overwritten.

This is the case with Filebeat inputs and modules sharing the same name:

module/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

input/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

Also this introduces an inconsistence as the order of registration can
vary.

Fixes #13768
adriansr added a commit to adriansr/beats that referenced this issue Oct 14, 2019
@adriansr
Field registry: Don't overwrite fields with same name (elastic#13914)
1526fef 
When fields are registered (fields.go, autogenerated), they are grouped
by (Beatname, Name and Priority). Currently, if the same triplet is used
more than once, the previous asset is overwritten.

This is the case with Filebeat inputs and modules sharing the same name:

module/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

input/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

Also this introduces an inconsistence as the order of registration can
vary.

Fixes elastic#13768

(cherry picked from commit 4be5efe)
@adriansr adriansr mentioned this issue Oct 14, 2019
Merged
adriansr added a commit that referenced this issue Oct 14, 2019
@adriansr
Field registry: Don't overwrite fields with same name (#13914) (#14037)
96f20f9 
When fields are registered (fields.go, autogenerated), they are grouped
by (Beatname, Name and Priority). Currently, if the same triplet is used
more than once, the previous asset is overwritten.

This is the case with Filebeat inputs and modules sharing the same name:

module/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

input/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

Also this introduces an inconsistence as the order of registration can
vary.

Fixes #13768

(cherry picked from commit 4be5efe)
leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
@adriansr
Field registry: Don't overwrite fields with same name (elastic#13914) (…
24ef6fb 
…elastic#14037)

When fields are registered (fields.go, autogenerated), they are grouped
by (Beatname, Name and Priority). Currently, if the same triplet is used
more than once, the previous asset is overwritten.

This is the case with Filebeat inputs and modules sharing the same name:

module/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

input/netflow/fields.go:
  asset.SetFields("filebeat", "netflow", asset.ModuleFieldsPri, AssetNetflow)

Also this introduces an inconsistence as the order of registration can
vary.

Fixes elastic#13768

(cherry picked from commit 5fec6bc)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Filebeat Filebeat x-pack Issues and pull requests for X-Pack features.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Field registry: Don't overwrite fields with same name adriansr/beats
1 participant
@andrewkroh