Skip to content

Commit 1687e5d

Browse files
bhapasbhapas
committed
Correct field types according to spec
1 parent edf2699 commit 1687e5d

File tree

2 files changed

+19
-19
lines changed

2 files changed

+19
-19
lines changed

‎modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,9 @@ enum DataType {
117117
entry("agentZoneExternalID", new ExtensionMapping("agentZoneExternalID", StringType, null)),
118118
entry("agentZoneURI", new ExtensionMapping("agentZoneURI", StringType, null)),
119119
entry("app", new ExtensionMapping("applicationProtocol", StringType, "network.protocol")),
120-
entry("cnt", new ExtensionMapping("baseEventCount", LongType, null)),
121-
entry("in", new ExtensionMapping("bytesIn", LongType, "source.bytes")),
122-
entry("out", new ExtensionMapping("bytesOut", LongType, "destination.bytes")),
120+
entry("cnt", new ExtensionMapping("baseEventCount", IntegerType, null)),
121+
entry("in", new ExtensionMapping("bytesIn", IntegerType, "source.bytes")),
122+
entry("out", new ExtensionMapping("bytesOut", IntegerType, "destination.bytes")),
123123
entry("customerExternalID", new ExtensionMapping("customerExternalID", StringType, "organization.id")),
124124
entry("customerURI", new ExtensionMapping("customerURI", StringType, "organization.name")),
125125
entry("dst", new ExtensionMapping("destinationAddress", IPType, "destination.ip")),
@@ -130,7 +130,7 @@ enum DataType {
130130
entry("dmac", new ExtensionMapping("destinationMacAddress", MACAddressType, "destination.mac")),
131131
entry("dntdom", new ExtensionMapping("destinationNtDomain", StringType, "destination.registered_domain")),
132132
entry("dpt", new ExtensionMapping("destinationPort", IntegerType, "destination.port")),
133-
entry("dpid", new ExtensionMapping("destinationProcessId", LongType, "destination.process.pid")),
133+
entry("dpid", new ExtensionMapping("destinationProcessId", IntegerType, "destination.process.pid")),
134134
entry("dproc", new ExtensionMapping("destinationProcessName", StringType, "destination.process.name")),
135135
entry("destinationServiceName", new ExtensionMapping("destinationServiceName", StringType, "destination.service.name")),
136136
entry("destinationTranslatedAddress", new ExtensionMapping("destinationTranslatedAddress", IPType, "destination.nat.ip")),
@@ -193,7 +193,7 @@ enum DataType {
193193
entry("deviceNtDomain", new ExtensionMapping("deviceNtDomain", StringType, null)),
194194
entry("deviceOutboundInterface", new ExtensionMapping("deviceOutboundInterface", StringType, "observer.egress.interface.name")),
195195
entry("devicePayloadId", new ExtensionMapping("devicePayloadId", StringType, "event.id")),
196-
entry("dvcpid", new ExtensionMapping("deviceProcessId", LongType, "process.pid")),
196+
entry("dvcpid", new ExtensionMapping("deviceProcessId", IntegerType, "process.pid")),
197197
entry("deviceProcessName", new ExtensionMapping("deviceProcessName", StringType, "process.name")),
198198
entry("rt", new ExtensionMapping("deviceReceiptTime", TimestampType, "@timestamp")),
199199
entry("dtz", new ExtensionMapping("deviceTimeZone", StringType, "event.timezone")),
@@ -217,7 +217,7 @@ enum DataType {
217217
entry("fname", new ExtensionMapping("filename", StringType, "file.name")),
218218
entry("filePath", new ExtensionMapping("filePath", StringType, "file.path")),
219219
entry("filePermission", new ExtensionMapping("filePermission", StringType, "file.group")),
220-
entry("fsize", new ExtensionMapping("fileSize", IntegerType, "file.size")),
220+
entry("fsize", new ExtensionMapping("fileSize", LongType, "file.size")),
221221
entry("fileType", new ExtensionMapping("fileType", StringType, "file.type")),
222222
entry("flexDate1", new ExtensionMapping("flexDate1", TimestampType, null)),
223223
entry("flexDate1Label", new ExtensionMapping("flexDate1Label", StringType, null)),
@@ -233,7 +233,7 @@ enum DataType {
233233
entry("oldFileName", new ExtensionMapping("oldFileName", StringType, null)),
234234
entry("oldFilePath", new ExtensionMapping("oldFilePath", StringType, null)),
235235
entry("oldFilePermission", new ExtensionMapping("oldFilePermission", StringType, null)),
236-
entry("oldFileSize", new ExtensionMapping("oldFileSize", IntegerType, null)),
236+
entry("oldFileSize", new ExtensionMapping("oldFileSize", LongType, null)),
237237
entry("oldFileType", new ExtensionMapping("oldFileType", StringType, null)),
238238
entry("rawEvent", new ExtensionMapping("rawEvent", StringType, "event.original")),
239239
entry("reason", new ExtensionMapping("reason", StringType, "event.reason")),
@@ -250,7 +250,7 @@ enum DataType {
250250
entry("smac", new ExtensionMapping("sourceMacAddress", MACAddressType, "source.mac")),
251251
entry("sntdom", new ExtensionMapping("sourceNtDomain", StringType, "source.registered_domain")),
252252
entry("spt", new ExtensionMapping("sourcePort", IntegerType, "source.port")),
253-
entry("spid", new ExtensionMapping("sourceProcessId", LongType, "source.process.pid")),
253+
entry("spid", new ExtensionMapping("sourceProcessId", IntegerType, "source.process.pid")),
254254
entry("sproc", new ExtensionMapping("sourceProcessName", StringType, "source.process.name")),
255255
entry("sourceServiceName", new ExtensionMapping("sourceServiceName", StringType, "source.service.name")),
256256
entry("sourceTranslatedAddress", new ExtensionMapping("sourceTranslatedAddress", IPType, "source.nat.ip")),

‎modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/CefProcessorTests.java‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@ public void testInvalidCefFormat() {
8787

8888
public void testStandardMessage() {
8989
String message = "CEF:26|security|threatmanager|1.0|100|trojan successfully stopped|10|"
90-
+ "src=10.0.0.192 dst=12.121.122.82 spt=1232 eventId=1 in=4294967296 out=4294967296";
90+
+ "src=10.0.0.192 dst=12.121.122.82 spt=1232 eventId=1 in=4294 out=4294";
9191
Map<String, Object> source = new HashMap<>();
9292
source.put("message", message);
9393
document = new IngestDocument("index", "id", 1L, null, null, source);
@@ -109,8 +109,8 @@ public void testStandardMessage() {
109109
)
110110
),
111111
entry("observer", Map.of("product", "threatmanager", "vendor", "security", "version", "1.0")),
112-
entry("source", Map.of("ip", "10.0.0.192", "port", 1232, "bytes", 4294967296L)),
113-
entry("destination", Map.of("ip", "12.121.122.82", "bytes", 4294967296L)),
112+
entry("source", Map.of("ip", "10.0.0.192", "port", 1232, "bytes", 4294)),
113+
entry("destination", Map.of("ip", "12.121.122.82", "bytes", 4294)),
114114
entry("event", Map.of("id", "1", "code", "100")),
115115
entry("message", message)
116116
)
@@ -817,9 +817,9 @@ public void testAllFieldsInExtension() {
817817
entry("deviceCustomFloatingPoint1Label", "cfp1Label"),
818818
entry("deviceCustomIPv6Address3Label", "c6a3Label"),
819819
entry("deviceCustomFloatingPoint4Label", "cfp4Label"),
820-
entry("oldFileSize", 2048),
820+
entry("oldFileSize", 2048L),
821821
entry("externalId", "extId"),
822-
entry("baseEventCount", 1234L),
822+
entry("baseEventCount", 1234),
823823
entry("flexString2", "flexString2"),
824824
entry("deviceCustomNumber3Label", "cn3Label"),
825825
entry("flexString1", "flexString1"),
@@ -869,16 +869,16 @@ public void testAllFieldsInExtension() {
869869
entry("mac", "00:0a:95:9d:68:16")
870870
)
871871
),
872-
entry("process", Map.of("name", "procName", "pid", 5678L)),
872+
entry("process", Map.of("name", "procName", "pid", 5678)),
873873
entry(
874874
"destination",
875875
Map.ofEntries(
876876
entry("nat", Map.of("port", 8080, "ip", "10.0.0.2")),
877877
entry("geo", Map.of("location", Map.of("lon", -122.4194, "lat", 37.7749))),
878878
entry("registered_domain", "destNtDomain"),
879-
entry("process", Map.of("name", "destProc", "pid", 1234L)),
879+
entry("process", Map.of("name", "destProc", "pid", 1234)),
880880
entry("port", 80),
881-
entry("bytes", 91011L),
881+
entry("bytes", 91011),
882882
entry("service", Map.of("name", "destService")),
883883
entry("domain", "destHost"),
884884
entry("ip", "192.168.0.2"),
@@ -892,10 +892,10 @@ public void testAllFieldsInExtension() {
892892
entry("geo", Map.of("location", Map.of("lon", -122.4194, "lat", 37.7749))),
893893
entry("nat", Map.of("port", 8081, "ip", "10.0.0.4")),
894894
entry("registered_domain", "sourceNtDomain"),
895-
entry("process", Map.of("name", "sourceProc", "pid", 1234L)),
895+
entry("process", Map.of("name", "sourceProc", "pid", 1234)),
896896
entry("port", 443),
897897
entry("service", Map.of("name", "sourceService")),
898-
entry("bytes", 5678L),
898+
entry("bytes", 5678),
899899
entry("ip", "192.168.0.4"),
900900
entry("domain", "sourceDomain"),
901901
entry("user", Map.of("name", "sourceUser", "id", "sourceUserId", "group", Map.of("name", "sourcePriv"))),
@@ -910,7 +910,7 @@ public void testAllFieldsInExtension() {
910910
Map.ofEntries(
911911
entry("inode", "5678"),
912912
entry("path", "/path/to/file"),
913-
entry("size", 1024),
913+
entry("size", 1024L),
914914
entry("created", ZonedDateTime.parse("2021-06-01T11:43:20Z")),
915915
entry("name", "file.txt"),
916916
entry("mtime", ZonedDateTime.parse("2021-06-01T11:45Z")),

0 commit comments

Comments
 (0)