Fix datatypes as per spec

The field datatypes are fixed according the CEF spec V27

Author: bhapas

modules/ingest-common/src/main/java/org/elasticsearch/ingest/common/CefParser.java

@@ -117,7 +117,7 @@ enum DataType {
         entry("agentZoneExternalID", new ExtensionMapping("agentZoneExternalID", StringType, null)),
         entry("agentZoneURI", new ExtensionMapping("agentZoneURI", StringType, null)),
         entry("app", new ExtensionMapping("applicationProtocol", StringType, "network.protocol")),
-        entry("cnt", new ExtensionMapping("baseEventCount", IntegerType, null)),
+        entry("cnt", new ExtensionMapping("baseEventCount", LongType, null)),
         entry("in", new ExtensionMapping("bytesIn", LongType, "source.bytes")),
         entry("out", new ExtensionMapping("bytesOut", LongType, "destination.bytes")),
         entry("customerExternalID", new ExtensionMapping("customerExternalID", StringType, "organization.id")),
@@ -151,11 +151,11 @@ enum DataType {
         entry("deviceCustomDate1Label", new ExtensionMapping("deviceCustomDate1Label", StringType, null)),
         entry("deviceCustomDate2", new ExtensionMapping("deviceCustomDate2", TimestampType, null)),
         entry("deviceCustomDate2Label", new ExtensionMapping("deviceCustomDate2Label", StringType, null)),
-        entry("cfp1", new ExtensionMapping("deviceCustomFloatingPoint1", FloatType, null)),
-        entry("cfp2", new ExtensionMapping("deviceCustomFloatingPoint2", FloatType, null)),
+        entry("cfp1", new ExtensionMapping("deviceCustomFloatingPoint1", DoubleType, null)),
+        entry("cfp2", new ExtensionMapping("deviceCustomFloatingPoint2", DoubleType, null)),
         entry("cfp2Label", new ExtensionMapping("deviceCustomFloatingPoint2Label", StringType, null)),
-        entry("cfp3", new ExtensionMapping("deviceCustomFloatingPoint3", FloatType, null)),
-        entry("cfp4", new ExtensionMapping("deviceCustomFloatingPoint4", FloatType, null)),
+        entry("cfp3", new ExtensionMapping("deviceCustomFloatingPoint3", DoubleType, null)),
+        entry("cfp4", new ExtensionMapping("deviceCustomFloatingPoint4", DoubleType, null)),
         entry("c6a1", new ExtensionMapping("deviceCustomIPv6Address1", IPType, null)),
         entry("c6a1Label", new ExtensionMapping("deviceCustomIPv6Address1Label", StringType, null)),
         entry("c6a2", new ExtensionMapping("deviceCustomIPv6Address2", IPType, null)),
@@ -186,7 +186,7 @@ enum DataType {
         entry("deviceDnsDomain", new ExtensionMapping("deviceDnsDomain", StringType, "observer.registered_domain")),
         entry("cat", new ExtensionMapping("deviceEventCategory", StringType, null)),
         entry("deviceExternalId", new ExtensionMapping("deviceExternalId", StringType, "observer.name")),
-        entry("deviceFacility", new ExtensionMapping("deviceFacility", LongType, "log.syslog.facility.code")),
+        entry("deviceFacility", new ExtensionMapping("deviceFacility", IntegerType, "log.syslog.facility.code")),
         entry("dvchost", new ExtensionMapping("deviceHostName", StringType, "observer.hostname")),
         entry("deviceInboundInterface", new ExtensionMapping("deviceInboundInterface", StringType, "observer.ingress.interface.name")),
         entry("dvcmac", new ExtensionMapping("deviceMacAddress", MACAddressType, "observer.mac")),
@@ -217,7 +217,7 @@ enum DataType {
         entry("fname", new ExtensionMapping("filename", StringType, "file.name")),
         entry("filePath", new ExtensionMapping("filePath", StringType, "file.path")),
         entry("filePermission", new ExtensionMapping("filePermission", StringType, "file.group")),
-        entry("fsize", new ExtensionMapping("fileSize", LongType, "file.size")),
+        entry("fsize", new ExtensionMapping("fileSize", IntegerType, "file.size")),
         entry("fileType", new ExtensionMapping("fileType", StringType, "file.type")),
         entry("flexDate1", new ExtensionMapping("flexDate1", TimestampType, null)),
         entry("flexDate1Label", new ExtensionMapping("flexDate1Label", StringType, null)),
@@ -264,7 +264,7 @@ enum DataType {
         entry("sourceZoneURI", new ExtensionMapping("sourceZoneURI", StringType, null)),
         entry("start", new ExtensionMapping("startTime", TimestampType, "event.start")),
         entry("proto", new ExtensionMapping("transportProtocol", StringType, "network.transport")),
-        entry("type", new ExtensionMapping("type", IntegerType, "event.kind")),
+        entry("type", new ExtensionMapping("type", StringType, "event.kind")),
         entry("catdt", new ExtensionMapping("categoryDeviceType", StringType, null)),
         entry("mrt", new ExtensionMapping("managerReceiptTime", TimestampType, "event.ingested"))
     );

modules/ingest-common/src/test/java/org/elasticsearch/ingest/common/CefProcessorTests.java

@@ -766,11 +766,11 @@ public void testAllFieldsInExtension() {
                                 entry("deviceCustomString1", "customString1"),
                                 entry("deviceCustomIPv6Address2Label", "c6a2Label"),
                                 entry("deviceCustomNumber3", 345L),
-                                entry("deviceCustomFloatingPoint1", 1.23f),
+                                entry("deviceCustomFloatingPoint1", 1.23),
                                 entry("deviceCustomNumber2", 234L),
-                                entry("deviceCustomFloatingPoint2", 2.34f),
-                                entry("deviceCustomFloatingPoint3", 3.45f),
-                                entry("deviceCustomFloatingPoint4", 4.56f),
+                                entry("deviceCustomFloatingPoint2", 2.34),
+                                entry("deviceCustomFloatingPoint3", 3.45),
+                                entry("deviceCustomFloatingPoint4", 4.56),
                                 entry("flexDate1", ZonedDateTime.parse("2021-06-01T11:43:20Z")),
                                 entry("destinationTranslatedZoneExternalID", "destExtId"),
                                 entry("deviceCustomNumber1", 123L),
@@ -819,7 +819,7 @@ public void testAllFieldsInExtension() {
                                 entry("deviceCustomFloatingPoint4Label", "cfp4Label"),
                                 entry("oldFileSize", 2048),
                                 entry("externalId", "extId"),
-                                entry("baseEventCount", 1234),
+                                entry("baseEventCount", 1234L),
                                 entry("flexString2", "flexString2"),
                                 entry("deviceCustomNumber3Label", "cn3Label"),
                                 entry("flexString1", "flexString1"),
@@ -842,7 +842,7 @@ public void testAllFieldsInExtension() {
                     )
                 ),
                 entry("host", Map.of("nat", Map.of("ip", "10.0.0.3"))),
-                entry("log", Map.of("syslog", Map.of("facility", Map.of("code", 16L)))),
+                entry("log", Map.of("syslog", Map.of("facility", Map.of("code", 16)))),
                 entry(
                     "observer",
                     Map.ofEntries(
@@ -910,7 +910,7 @@ public void testAllFieldsInExtension() {
                     Map.ofEntries(
                         entry("inode", "5678"),
                         entry("path", "/path/to/file"),
-                        entry("size", 1024L),
+                        entry("size", 1024),
                         entry("created", ZonedDateTime.parse("2021-06-01T11:43:20Z")),
                         entry("name", "file.txt"),
                         entry("mtime", ZonedDateTime.parse("2021-06-01T11:45Z")),
@@ -932,7 +932,7 @@ public void testAllFieldsInExtension() {
                         entry("start", ZonedDateTime.parse("2021-06-01T11:43:20Z")),
                         entry("reason", "reason"),
                         entry("ingested", ZonedDateTime.parse("2021-06-01T11:43:20Z")),
-                        entry("kind", 1),
+                        entry("kind", "1"),
                         entry("original", "rawEvent"),
                         entry("created", ZonedDateTime.parse("2021-06-01T11:43:20Z")),
                         entry("code", "100")