From ab555bc254b847f9a0592f5c87e0589a15dc395d Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Wed, 10 Apr 2024 11:43:48 +0300 Subject: [PATCH] [8.13](backport #38780) [filebeat/netflow]: set event normalisation to true (#38802) * [filebeat/netflow]: set event normalisation to true (#38780) * fix(input/netflow): revert event normalisation to true for netflow input * doc: update CHANGELOG.next.asciidoc * fix: update fields.asciidoc (unrelated to this work) * doc: remove irrelevant comment (cherry picked from commit 2f5ee744ecea47e66eab17491723f1227eaa09a4) * doc: remove irrelevant changes from CHANGELOG.next.asciidoc --------- Co-authored-by: Panos Koutsovasilis --- CHANGELOG.next.asciidoc | 1 + x-pack/filebeat/input/netflow/input.go | 4 +--- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 1a84868343c..7114d9659ce 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -74,6 +74,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Fix handling of Juniper SRX structured data when there is no leading junos element. {issue}36270[36270] {pull}36308[36308] - Fix Filebeat Cisco module with missing escape character {issue}36325[36325] {pull}36326[36326] - Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496] +- Fix indexing failures by re-enabling event normalisation in netflow input. {issue}38703[38703] {pull}38780[38780] *Heartbeat* diff --git a/x-pack/filebeat/input/netflow/input.go b/x-pack/filebeat/input/netflow/input.go index addd3d39c25..26aa3927503 100644 --- a/x-pack/filebeat/input/netflow/input.go +++ b/x-pack/filebeat/input/netflow/input.go @@ -147,9 +147,7 @@ func (n *netflowInput) Run(context v2.Context, connector beat.PipelineConnector) client, err := connector.ConnectWith(beat.ClientConfig{ PublishMode: beat.DefaultGuarantees, Processing: beat.ProcessingConfig{ - // This input only produces events with basic types so normalization - // is not required. - EventNormalization: boolPtr(false), + EventNormalization: boolPtr(true), }, CloseRef: context.Cancelation, EventListener: nil,