[8.14](backport #39134) [Auditbeat] Remove temporary "ReplaceFields" config option

x-pack/auditbeat/processors/sessionmd/add_session_metadata.go

@@ -11,7 +11,6 @@ import (
  "fmt"
  "reflect"
  "strconv"
- "time"
 
  "github.com/elastic/beats/v7/libbeat/beat"
  "github.com/elastic/beats/v7/libbeat/processors"
@@ -113,8 +112,8 @@ func (p *addSessionMetadata) Run(ev *beat.Event) (*beat.Event, error) {
 }
 
 func (p *addSessionMetadata) String() string {
- return fmt.Sprintf("%v=[backend=%s, pid_field=%s, replace_fields=%t]",
- processorName, p.config.Backend, p.config.PIDField, p.config.ReplaceFields)
+ return fmt.Sprintf("%v=[backend=%s, pid_field=%s]",
+ processorName, p.config.Backend, p.config.PIDField)
 }
 
 func (p *addSessionMetadata) enrich(ev *beat.Event) (*beat.Event, error) {
@@ -148,12 +147,6 @@ func (p *addSessionMetadata) enrich(ev *beat.Event) (*beat.Event, error) {
  return nil, fmt.Errorf("merging enriched fields with event: %w", err)
  }
  result.Fields["process"] = m
-
- if p.config.ReplaceFields {
- if err := p.replaceFields(result); err != nil {
- return nil, fmt.Errorf("replace fields: %w", err)
- }
- }
  return result, nil
 }
 
@@ -184,40 +177,6 @@ func pidToUInt32(value interface{}) (pid uint32, err error) {
  return pid, nil
 }
 
-// replaceFields replaces event fields with values suitable user with the session viewer in Kibana
-// The current version of session view in Kibana expects different values than what are used by auditbeat
-// for some fields. This function converts these field to have values that will work with session view.
-//
-// This function is temporary, and can be removed when this Kibana issue is completed: https:/elastic/kibana/issues/179396.
-func (p *addSessionMetadata) replaceFields(ev *beat.Event) error {
- kind, err := ev.Fields.GetValue("event.kind")
- if err != nil {
- return err
- }
- isAuditdEvent, err := ev.Fields.HasKey("auditd")
- if err != nil {
- return err
- }
- if kind == "event" && isAuditdEvent {
- // process start
- syscall, err := ev.Fields.GetValue("auditd.data.syscall")
- if err != nil {
- return nil //nolint:nilerr // processor can be called on unsupported events; not an error
- }
- switch syscall {
- case "execveat", "execve":
- ev.Fields.Put("event.action", []string{"exec", "fork"})
- ev.Fields.Put("event.type", []string{"start"})
-
- case "exit_group":
- ev.Fields.Put("event.action", []string{"end"})
- ev.Fields.Put("event.type", []string{"end"})
- ev.Fields.Put("process.end", time.Now())
- }
- }
- return nil
-}
-
 func tryToMapStr(v interface{}) (mapstr.M, bool) {
  switch m := v.(type) {
  case mapstr.M:

x-pack/auditbeat/processors/sessionmd/add_session_metadata_test.go

@@ -32,8 +32,7 @@ var (
  {
  testName: "enrich process",
  config: config{
- ReplaceFields: false,
- PIDField: "process.pid",
+ PIDField: "process.pid",
  },
  mockProcesses: []types.ProcessExecEvent{
  {
@@ -94,8 +93,7 @@ var (
  {
  testName: "no PID field in event",
  config: config{
- ReplaceFields: false,
- PIDField: "process.pid",
+ PIDField: "process.pid",
  },
  input: beat.Event{
  Fields: mapstr.M{
@@ -113,8 +111,7 @@ var (
  {
  testName: "PID not number",
  config: config{
- ReplaceFields: false,
- PIDField: "process.pid",
+ PIDField: "process.pid",
  },
  input: beat.Event{
  Fields: mapstr.M{
@@ -133,8 +130,7 @@ var (
  {
  testName: "PID not in DB",
  config: config{
- ReplaceFields: false,
- PIDField: "process.pid",
+ PIDField: "process.pid",
  },
  input: beat.Event{
  Fields: mapstr.M{
@@ -154,8 +150,7 @@ var (
  testName: "process field not in event",
  // This event, without a "process" field, is not supported by enrich, it should be handled gracefully
  config: config{
- ReplaceFields: false,
- PIDField: "action.pid",
+ PIDField: "action.pid",
  },
  input: beat.Event{
  Fields: mapstr.M{
@@ -170,8 +165,7 @@ var (
  testName: "process field not mapstr",
  // Unsupported process field type should be handled gracefully
  config: config{
- ReplaceFields: false,
- PIDField: "action.pid",
+ PIDField: "action.pid",
  },
  input: beat.Event{
  Fields: mapstr.M{
@@ -189,8 +183,7 @@ var (
  {
  testName: "enrich event with map[string]any process field",
  config: config{
- ReplaceFields: false,
- PIDField: "process.pid",
+ PIDField: "process.pid",
  },
  mockProcesses: []types.ProcessExecEvent{
  {

x-pack/auditbeat/processors/sessionmd/config.go

@@ -8,15 +8,13 @@ package sessionmd
 
 // Config for add_session_metadata processor.
 type config struct {
- Backend string `config:"backend"`
- ReplaceFields bool `config:"replace_fields"`
- PIDField string `config:"pid_field"`
+ Backend string `config:"backend"`
+ PIDField string `config:"pid_field"`
 }
 
 func defaultConfig() config {
  return config{
- Backend: "auto",
- ReplaceFields: false,
- PIDField: "process.pid",
+ Backend: "auto",
+ PIDField: "process.pid",
  }
 }