[Filebeat] Filebeat Processors - Make URI Parts Processor Available To Filebeat

[mr1716]

Hey all, and thanks for all of the work with this wonderful software.

The request is to make the existing ElasticSearch URI Parts Processor available to native Filebeat input processing.

There is already the URL Decode processor in Filebeat and adding a URI Parts processor would help keep things consistent, plus be extremely useful and potentially speed up processing. Also, User Agent would be helpful, but will add another enhancement request for that.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[mr1716]

@mtojek Thanks for adding a label. Would it also be worth adding the enhancement and Filebeat labels in addition to the existing
label? @jlind23

[jlind23]

@mr1716 No worries, I'll take care of this 😄

[mr1716]

@jlind23 Thank you very much! It is greatly appreciated! This is one of the more popular elastic processors seen in Filebeat Pipelines, so it will be great to get this ported into Filebeat.

[mr1716]

@jlind23 why was this removed from 8.3? Will this be integrated into a later release or dropped entirely?

[jlind23]

Hi @mr1716 I removed it due to other higher priorities that we needed to work one, this is part of our prioritization process.
This is not dropped at all, it is rather a matter of priority.

[nimarezainia]

@mr1716 we are considering making this enhancement to the Elastic Agent. Would you be able to migrate to using the agent in the near future? Almost all integrations give the user the ability to apply processors and we could make this enhancement there. thax

[mr1716]

@nimarezainia Would the elastic agent be able to run filebeat modules? If not, then this needs to be part of filebeat. The request is strictly for filebeat.

[UcanInfosec]

Any updates on this? I’ve been watching this for a bit and curious about it’s progress.

[woodywalton]

Had one of my customers make this request today as well, any updates?

[nimarezainia]

@mr1716 sorry for the delay. Almost all the filebeat modules are supported as integration on the Elastic Agent. Can you tell me which filebeat module you are interested in so I can double check.

[mr1716]

@nimarezainia It's the AWS Module. Specifically the AWS ELB module. It has geoip, uri_parts, and user_agent in it. I'm not necessarily looking for an integration with the Elastic Agent. Rather I am looking for it to be natively supported in Filebeat as a Filebeat Process. Unless you're telling me that Filebeat will not be supported and depreciated after a certain date and replaced with the Elastic Agent.

[nimarezainia]

@mr1716 the AWS ELB module is also supported on the Elastic Agent: https://docs.elastic.co/integrations/aws/elb it should be on par with what you have on filebeat.

to answer your other question, there are currently no plans to deprecate filebeat. but broadly speaking, I would like to understand if there are other impediments to migrating to Elastic Agent so that we can better address the need. Hope that makes sense.

[mr1716]

@nimarezainia that makes sense. Is there a reason why this request wouldnt be implemented? Even if I go with the Elastic Agent, this request is still valid and necessary for those using filebeat.

[nimarezainia]

the only reason why there's a delay in developing this feature is that we have many other priorities currently and need to focus on implementing them. We will no doubt get to this one. thanks.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!

[mr1716]

👍

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!