Skip to content

Commit

Permalink
Remove experimental event.original definition (#1053)
Browse files Browse the repository at this point in the history
  • Loading branch information
ebeahan authored Nov 10, 2020
1 parent d9df1ab commit 18fc6af
Show file tree
Hide file tree
Showing 7 changed files with 10 additions and 10 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ All notable changes to this project will be documented in this file based on the
#### Bugfixes

* Addressed issue where foreign reuses weren't using the user-supplied `as` value for their destination. #960
* Experimental artifacts failed to install due to `event.original` index setting. #1053

#### Added

Expand Down
3 changes: 2 additions & 1 deletion experimental/generated/beats/fields.ecs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -1317,7 +1317,8 @@
example: apache
- name: original
level: core
type: wildcard
type: keyword
ignore_above: 1024
description: 'Raw text message of entire event. Used to demonstrate log integrity.
This field is not indexed and doc_values are disabled. It cannot be searched,
Expand Down
2 changes: 1 addition & 1 deletion experimental/generated/csv/fields.csv
Original file line number Diff line number Diff line change
Expand Up @@ -149,7 +149,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
2.0.0-dev,true,event,event.ingested,date,core,,2016-05-23T08:05:35.101Z,Timestamp when an event arrived in the central data store.
2.0.0-dev,true,event,event.kind,keyword,core,,alert,The kind of the event. The highest categorization field in the hierarchy.
2.0.0-dev,true,event,event.module,keyword,core,,apache,Name of the module this data is coming from.
2.0.0-dev,false,event,event.original,wildcard,core,,Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232,Raw text message of entire event.
2.0.0-dev,false,event,event.original,keyword,core,,Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100| worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232,Raw text message of entire event.
2.0.0-dev,true,event,event.outcome,keyword,core,,success,The outcome of the event. The lowest level categorization field in the hierarchy.
2.0.0-dev,true,event,event.provider,keyword,extended,,kernel,Source of the event.
2.0.0-dev,true,event,event.reason,keyword,extended,,Terminated an unexpected process,"Reason why this event happened, according to the source"
Expand Down
3 changes: 2 additions & 1 deletion experimental/generated/ecs/ecs_flat.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2038,12 +2038,13 @@ event.original:
example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100|
worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232
flat_name: event.original
ignore_above: 1024
index: false
level: core
name: original
normalize: []
short: Raw text message of entire event.
type: wildcard
type: keyword
event.outcome:
allowed_values:
- description: Indicates that this event describes a failed result. A common example
Expand Down
3 changes: 2 additions & 1 deletion experimental/generated/ecs/ecs_nested.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2436,12 +2436,13 @@ event:
example: Sep 19 08:26:10 host CEF:0|Security| threatmanager|1.0|100|
worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2spt=1232
flat_name: event.original
ignore_above: 1024
index: false
level: core
name: original
normalize: []
short: Raw text message of entire event.
type: wildcard
type: keyword
event.outcome:
allowed_values:
- description: Indicates that this event describes a failed result. A common
Expand Down
3 changes: 2 additions & 1 deletion experimental/generated/elasticsearch/7/template.json
Original file line number Diff line number Diff line change
Expand Up @@ -706,8 +706,9 @@
},
"original": {
"doc_values": false,
"ignore_above": 1024,
"index": false,
"type": "wildcard"
"type": "keyword"
},
"outcome": {
"ignore_above": 1024,
Expand Down
5 changes: 0 additions & 5 deletions experimental/schemas/event.yml

This file was deleted.

0 comments on commit 18fc6af

Please sign in to comment.