Skip to content

[GCP] Preserve original value of resource name#13633

Merged
kcreddy merged 2 commits intoelastic:mainfrom
moxarth-rathod:6024-gcp-preserver-original-value
Apr 22, 2025
Merged

[GCP] Preserve original value of resource name#13633
kcreddy merged 2 commits intoelastic:mainfrom
moxarth-rathod:6024-gcp-preserver-original-value

Conversation

@moxarth-rathod
Copy link
Contributor

@moxarth-rathod moxarth-rathod commented Apr 22, 2025

Proposed commit message

GCP : Add gcp.audit.resource_name for k8s audit logs

Remove condition on json.protoPayload.resourceName to preserve original value. This field is used to
extract orchestrator-related information in Kubernetes logs, and grok is already applied for extracting
details. Removing the condition helps retain the original value.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/gcp directory.
  • Run the following command to run tests.

elastic-package test

Related issues

@moxarth-rathod moxarth-rathod added Integration:gcp Google Cloud Platform bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Apr 22, 2025
@moxarth-rathod moxarth-rathod self-assigned this Apr 22, 2025
@moxarth-rathod moxarth-rathod requested review from a team as code owners April 22, 2025 06:32
@elasticmachine
Copy link

elasticmachine commented Apr 22, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@moxarth-rathod moxarth-rathod mentioned this pull request Apr 22, 2025
Closed
5 tasks
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Apr 22, 2025

🚀 Benchmarks report

Package gcp 👍(4) 💚(0) 💔(2)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
firewall 4032.26 3021.15 -1011.11 (-25.08%) 💔
vpcflow 3952.57 2967.36 -985.21 (-24.93%) 💔

To see the full report comment with /test benchmark fullreport

@elastic-sonarqube
Copy link

elastic-sonarqube bot commented Apr 22, 2025

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

@elasticmachine
Copy link

elasticmachine commented Apr 22, 2025

💚 Build Succeeded

cc @moxarth-rathod

@kcreddy kcreddy merged commit e5a63de into elastic:main Apr 22, 2025
7 checks passed
ishleenk17
ishleenk17 reviewed Apr 22, 2025
View reviewed changes
packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
field: gcp.audit.resource_name
copy_from: json.protoPayload.resourceName
ignore_failure: true
if: ctx.orchestrator?.type != 'kubernetes'
Copy link
Member

@ishleenk17 ishleenk17 Apr 22, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we please check why this was excluded before?
Also, in case we are not using this. We might as well not have set orchestrator.type as we were creating and using that field only for this check.

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Apr 22, 2025

Package gcp - 2.41.1 containing this change is available at https://epr.elastic.co/package/gcp/2.41.1/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ishleenk17 ishleenk17 ishleenk17 left review comments

@kcreddy kcreddy kcreddy approved these changes

Assignees

@moxarth-rathod moxarth-rathod

Labels

bugfix Pull request that fixes a bug issue Integration:gcp Google Cloud Platform Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:Sit-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[GCP Audit Integration] gcp.audit.resource_name not extracted from k8s audit logs

4 participants

@moxarth-rathod @elasticmachine @kcreddy @ishleenk17