winlogbeat/sys/winevent: do not interpret dots as JSON path separators #34549
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
efd6
added
bug
Winlogbeat
Team:Security-External Integrations
backport-7.17
botelastic
bot
added
needs_team
In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion.
|
The linter is broken. golangci/golangci-lint-action#624 |
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsExpand to view the GitHub comments
To re-run your PR in the CI, just comment with:
|
andrewkroh
approved these changes
Feb 15, 2023
mergify bot
pushed a commit
that referenced
this pull request
Feb 15, 2023
#34549) In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion. (cherry picked from commit ab589ce) # Conflicts: # winlogbeat/sys/winevent/maputil.go
mergify bot
pushed a commit
that referenced
this pull request
Feb 15, 2023
#34549) In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion. (cherry picked from commit ab589ce)
mergify bot
pushed a commit
that referenced
this pull request
Feb 15, 2023
#34549) In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion. (cherry picked from commit ab589ce)
efd6
added a commit
that referenced
this pull request
Feb 15, 2023
#34549) (#34594) In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion. (cherry picked from commit ab589ce) Co-authored-by: Dan Kortschak <[email protected]>
efd6
added a commit
that referenced
this pull request
Feb 15, 2023
#34549) (#34595) In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion. (cherry picked from commit ab589ce) Co-authored-by: Dan Kortschak <[email protected]>
efd6
added a commit
that referenced
this pull request
Feb 28, 2023
…s as JSON path separators (#34593) * winlogbeat/sys/winevent: do not interpret dots as JSON path separators (#34549) In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion. (cherry picked from commit ab589ce) # Conflicts: # winlogbeat/sys/winevent/maputil.go * resolve conflicts Requires backport of testing infrastructure. --------- Co-authored-by: Dan Kortschak <[email protected]> Co-authored-by: Dan Kortschak <[email protected]>
chrisberkhout
pushed a commit
that referenced
this pull request
Jun 1, 2023
#34549) In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
In some locales, Windows abbreviates event data keys with dots. This happens in Spanish for example where the English 'ID' is rendered as 'Id.' When using
mapstr.Put, this dot is interpreted as a path separator, breaking the structure of the document and ultimately leading to an ingest failure. So use opaque key map insertion.Why is it important?
Breaks data ingestion in some lacales.
Checklist
CHANGELOG.next.asciidocorCHANGELOG-developer.next.asciidoc.Author's Checklist
failed to parse field [winlog.event_data.Id] of type [keyword]when id contains.#34345 and associated internal issue and the already existing allXML test case. In the absence of the fix, the test case fails as described in [Winlogbeat]failed to parse field [winlog.event_data.Id] of type [keyword]when id contains.#34345.How to test this PR locally
Related issues
failed to parse field [winlog.event_data.Id] of type [keyword]when id contains.#34345Use cases
Screenshots
Logs