From 2a714a1078f5c7dd009d6edfed9e8311366a39ca Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Tue, 8 Oct 2024 07:52:15 -0600 Subject: [PATCH] [8.15](backport #41099) [aws] Change log.file.path field in awscloudwatch input to nested object (#41163) * [aws] Change log.file.path field in awscloudwatch input to nested object (#41099) Change log.file.path field in awscloudwatch input to nested object (cherry picked from commit 904d14b664b14990a84905a06a63fe0e6f5ab650) --------- Co-authored-by: kaiyan-sheng --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/input/awscloudwatch/input_test.go | 6 +++++- x-pack/filebeat/input/awscloudwatch/processor.go | 8 ++++++-- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 0e2a00fe658f..3b9774c3c3b4 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -26,6 +26,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Removed deprecated Cylance from Beats. See <> for migration options. {pull}38037[38037] - Removed deprecated Bluecoat from Beats. See <> for migration options. {pull}38037[38037] - Introduce input/netmetrics and refactor netflow input metrics {pull}38055[38055] +- Change log.file.path field in awscloudwatch input to nested object. {pull}41099[41099] *Heartbeat* diff --git a/x-pack/filebeat/input/awscloudwatch/input_test.go b/x-pack/filebeat/input/awscloudwatch/input_test.go index 4f9754c6a130..6bc564658c0e 100644 --- a/x-pack/filebeat/input/awscloudwatch/input_test.go +++ b/x-pack/filebeat/input/awscloudwatch/input_test.go @@ -29,7 +29,11 @@ func TestCreateEvent(t *testing.T) { "event": mapstr.M{ "id": *logEvent.EventId, }, - "log.file.path": "logGroup1" + "/" + *logEvent.LogStreamName, + "log": mapstr.M{ + "file": mapstr.M{ + "path": "logGroup1" + "/" + *logEvent.LogStreamName, + }, + }, "awscloudwatch": mapstr.M{ "log_group": "logGroup1", "log_stream": *logEvent.LogStreamName, diff --git a/x-pack/filebeat/input/awscloudwatch/processor.go b/x-pack/filebeat/input/awscloudwatch/processor.go index 0ac2bc244d58..47630de622ce 100644 --- a/x-pack/filebeat/input/awscloudwatch/processor.go +++ b/x-pack/filebeat/input/awscloudwatch/processor.go @@ -44,8 +44,12 @@ func createEvent(logEvent types.FilteredLogEvent, logGroup string, regionName st event := beat.Event{ Timestamp: time.Unix(*logEvent.Timestamp/1000, 0).UTC(), Fields: mapstr.M{ - "message": *logEvent.Message, - "log.file.path": logGroup + "/" + *logEvent.LogStreamName, + "message": *logEvent.Message, + "log": mapstr.M{ + "file": mapstr.M{ + "path": logGroup + "/" + *logEvent.LogStreamName, + }, + }, "event": mapstr.M{ "id": *logEvent.EventId, "ingested": time.Now(),