From 88e873a2993095b37be948c2e9cda973533cdf93 Mon Sep 17 00:00:00 2001 From: gab Date: Thu, 21 Jul 2022 14:34:28 +0300 Subject: [PATCH 01/13] add storage data stream --- packages/gcp/_dev/build/docs/storage.md | 15 ++ packages/gcp/changelog.yml | 3 + .../storage/agent/stream/stream.yml.hbs | 16 ++ .../gcp/data_stream/storage/fields/agent.yml | 198 ++++++++++++++++++ .../storage/fields/base-fields.yml | 20 ++ .../gcp/data_stream/storage/fields/ecs.yml | 24 +++ .../gcp/data_stream/storage/fields/fields.yml | 31 +++ .../storage/fields/package-fields.yml | 31 +++ packages/gcp/data_stream/storage/manifest.yml | 31 +++ .../gcp/data_stream/storage/sample_event.json | 52 +++++ packages/gcp/docs/storage.md | 130 ++++++++++++ packages/gcp/manifest.yml | 10 + 12 files changed, 561 insertions(+) create mode 100644 packages/gcp/_dev/build/docs/storage.md create mode 100644 packages/gcp/data_stream/storage/agent/stream/stream.yml.hbs create mode 100644 packages/gcp/data_stream/storage/fields/agent.yml create mode 100644 packages/gcp/data_stream/storage/fields/base-fields.yml create mode 100644 packages/gcp/data_stream/storage/fields/ecs.yml create mode 100644 packages/gcp/data_stream/storage/fields/fields.yml create mode 100644 packages/gcp/data_stream/storage/fields/package-fields.yml create mode 100644 packages/gcp/data_stream/storage/manifest.yml create mode 100644 packages/gcp/data_stream/storage/sample_event.json create mode 100644 packages/gcp/docs/storage.md diff --git a/packages/gcp/_dev/build/docs/storage.md b/packages/gcp/_dev/build/docs/storage.md new file mode 100644 index 00000000000..136ea813f0e --- /dev/null +++ b/packages/gcp/_dev/build/docs/storage.md @@ -0,0 +1,15 @@ +# Storage + +## Metrics + +The `storage` dataset fetches metrics from [Storage](https://cloud.google.com/storage/) in Google Cloud Platform. It contains all metrics exported from the [GCP Storage Monitoring API](https://cloud.google.com/monitoring/api/metrics_gcp#gcp-storage). + +You can specify a single region to fetch metrics like `us-central1`. Be aware that GCP Storage does not use zones so `us-central1-a` will return nothing. If no region is specified, it will return metrics from all buckets. + +## Sample Event + +{{event "storage"}} + +## Exported fields + +{{fields "storage"}} \ No newline at end of file diff --git a/packages/gcp/changelog.yml b/packages/gcp/changelog.yml index 88485e4b160..c1363c6809d 100644 --- a/packages/gcp/changelog.yml +++ b/packages/gcp/changelog.yml @@ -32,6 +32,9 @@ - description: Add GCP Firestore Data stream type: enhancement link: https://github.com/elastic/integrations/pull/2704 + - description: Add GCP Storage Data Stream + type: enhancement + link: https://github.com/elastic/integrations/pull/3785 - version: "1.10.0" changes: - description: Update package to ECS 8.3.0. diff --git a/packages/gcp/data_stream/storage/agent/stream/stream.yml.hbs b/packages/gcp/data_stream/storage/agent/stream/stream.yml.hbs new file mode 100644 index 00000000000..35bdb8482b5 --- /dev/null +++ b/packages/gcp/data_stream/storage/agent/stream/stream.yml.hbs @@ -0,0 +1,16 @@ +metricsets: ["storage"] +period: {{period}} +project_id: {{project_id}} +{{#if credentials_file}} +credentials_file_path: {{credentials_file}} +{{/if}} +{{#if credentials_json}} +credentials_json: '{{credentials_json}}' +{{/if}} +{{#if region}} +region: {{region}} +{{/if}} +{{#if zone}} +zone: {{zone}} +{{/if}} +exclude_labels: {{exclude_labels}} diff --git a/packages/gcp/data_stream/storage/fields/agent.yml b/packages/gcp/data_stream/storage/fields/agent.yml new file mode 100644 index 00000000000..2a31d79f494 --- /dev/null +++ b/packages/gcp/data_stream/storage/fields/agent.yml @@ -0,0 +1,198 @@ +- name: cloud + title: Cloud + group: 2 + description: Fields related to the cloud or infrastructure the events are coming from. + footnote: 'Examples: If Metricbeat is running on an GCP Compute VM and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' + type: group + fields: + - name: account.id + level: extended + type: keyword + ignore_above: 1024 + description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. + + Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' + example: 666777888999 + - name: availability_zone + level: extended + type: keyword + ignore_above: 1024 + description: Availability zone in which this host is running. + example: us-east-1c + - name: instance.id + level: extended + type: keyword + ignore_above: 1024 + description: Instance ID of the host machine. + example: i-1234567890abcdef0 + - name: instance.name + level: extended + type: keyword + ignore_above: 1024 + description: Instance name of the host machine. + - name: machine.type + level: extended + type: keyword + ignore_above: 1024 + description: Machine type of the host machine. + example: t2.medium + - name: provider + level: extended + type: keyword + ignore_above: 1024 + description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. + example: aws + - name: region + level: extended + type: keyword + ignore_above: 1024 + description: Region in which this host is running. + example: us-east-1 + - name: project.id + type: keyword + description: Name of the project in Google Cloud. + - name: image.id + type: keyword + description: Image ID for the cloud instance. +- name: container + title: Container + group: 2 + description: 'Container fields are used for meta information about the specific container that is the source of information. + + These fields help correlate data based containers from any runtime.' + type: group + fields: + - name: id + level: core + type: keyword + ignore_above: 1024 + description: Unique container id. + - name: image.name + level: extended + type: keyword + ignore_above: 1024 + description: Name of the image the container was built on. + - name: labels + level: extended + type: object + object_type: keyword + description: Image labels. + - name: name + level: extended + type: keyword + ignore_above: 1024 + description: Container name. +- name: host + title: Host + group: 2 + description: 'A host is defined as a general computing instance. + + ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' + type: group + fields: + - name: architecture + level: core + type: keyword + ignore_above: 1024 + description: Operating system architecture. + example: x86_64 + - name: domain + level: extended + type: keyword + ignore_above: 1024 + description: 'Name of the domain of which the host is a member. + + For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' + example: CONTOSO + default_field: false + - name: hostname + level: core + type: keyword + ignore_above: 1024 + description: 'Hostname of the host. + + It normally contains what the `hostname` command returns on the host machine.' + - name: id + level: core + type: keyword + ignore_above: 1024 + description: 'Unique host id. + + As hostname is not always unique, use values that are meaningful in your environment. + + Example: The current usage of `beat.name`.' + - name: ip + level: core + type: ip + description: Host ip addresses. + - name: mac + level: core + type: keyword + ignore_above: 1024 + description: Host mac addresses. + - name: name + level: core + type: keyword + ignore_above: 1024 + description: 'Name of the host. + + It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' + - name: os.family + level: extended + type: keyword + ignore_above: 1024 + description: OS family (such as redhat, debian, freebsd, windows). + example: debian + - name: os.kernel + level: extended + type: keyword + ignore_above: 1024 + description: Operating system kernel version as a raw string. + example: 4.4.0-112-generic + - name: os.name + level: extended + type: keyword + ignore_above: 1024 + multi_fields: + - name: text + type: text + norms: false + default_field: false + description: Operating system name, without the version. + example: Mac OS X + - name: os.platform + level: extended + type: keyword + ignore_above: 1024 + description: Operating system platform (such centos, ubuntu, windows). + example: darwin + - name: os.version + level: extended + type: keyword + ignore_above: 1024 + description: Operating system version as a raw string. + example: 10.14.1 + - name: type + level: core + type: keyword + ignore_above: 1024 + description: 'Type of host. + + For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' + - name: containerized + type: boolean + description: > + If the host is a container. + + - name: os.build + type: keyword + example: "18D109" + description: > + OS build information. + + - name: os.codename + type: keyword + example: "stretch" + description: > + OS codename, if any. + diff --git a/packages/gcp/data_stream/storage/fields/base-fields.yml b/packages/gcp/data_stream/storage/fields/base-fields.yml new file mode 100644 index 00000000000..5f309fd4f78 --- /dev/null +++ b/packages/gcp/data_stream/storage/fields/base-fields.yml @@ -0,0 +1,20 @@ +- name: data_stream.type + type: constant_keyword + description: Data stream type. +- name: data_stream.dataset + type: constant_keyword + description: Data stream dataset. +- name: data_stream.namespace + type: constant_keyword + description: Data stream namespace. +- name: '@timestamp' + type: date + description: Event timestamp. +- name: event.module + type: constant_keyword + description: Event module + value: gcp +- name: event.dataset + type: constant_keyword + description: Event dataset + value: gcp.storage diff --git a/packages/gcp/data_stream/storage/fields/ecs.yml b/packages/gcp/data_stream/storage/fields/ecs.yml new file mode 100644 index 00000000000..83e3f6f1225 --- /dev/null +++ b/packages/gcp/data_stream/storage/fields/ecs.yml @@ -0,0 +1,24 @@ +- external: ecs + name: cloud +- external: ecs + name: cloud.account.id +- external: ecs + name: cloud.account.name +- external: ecs + name: cloud.availability_zone +- external: ecs + name: cloud.instance.id +- external: ecs + name: cloud.machine.type +- external: ecs + name: cloud.provider +- external: ecs + name: cloud.region +- external: ecs + name: ecs.version +- external: ecs + name: error +- external: ecs + name: error.message +- external: ecs + name: service.type diff --git a/packages/gcp/data_stream/storage/fields/fields.yml b/packages/gcp/data_stream/storage/fields/fields.yml new file mode 100644 index 00000000000..e2d6160aa00 --- /dev/null +++ b/packages/gcp/data_stream/storage/fields/fields.yml @@ -0,0 +1,31 @@ +- name: gcp.storage + description: Google Cloud Storage metrics + type: group + fields: + - name: api.request.count + type: long + description: Delta count of API calls, grouped by the API method name and response code. + - name: authz.acl_based_object_access_.ount + type: long + description: Delta count of requests that result in an object being granted access solely due to object ACLs. + - name: authz.acl_operations.count + type: long + description: Usage of ACL operations broken down by type. + - name: authz.object_specific_acl_mutation.count + type: long + description: Delta count of changes made to object specific ACLs. + - name: network.received.bytes + type: long + description: Delta count of bytes received over the network, grouped by the API method name and response code. + - name: network.sent.bytes + type: long + description: Delta count of bytes sent over the network, grouped by the API method name and response code. + - name: storage.object.count + type: long + description: Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. + - name: storage.total_byte_seconds.bytes + type: long + description: Delta count of bytes received over the network, grouped by the API method name and response code. + - name: storage.total.bytes + type: long + description: Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. diff --git a/packages/gcp/data_stream/storage/fields/package-fields.yml b/packages/gcp/data_stream/storage/fields/package-fields.yml new file mode 100644 index 00000000000..d8ccb93f502 --- /dev/null +++ b/packages/gcp/data_stream/storage/fields/package-fields.yml @@ -0,0 +1,31 @@ +- name: gcp + description: >- + GCP module + fields: + - name: labels + type: object + description: >- + GCP monitoring metrics labels + fields: + - name: user.* + type: object + object_type: keyword + - name: metadata.* + type: object + object_type: keyword + - name: metrics.* + type: object + object_type: keyword + - name: system.* + type: object + object_type: keyword + - name: resource.* + type: object + object_type: keyword + - name: "metrics.*.*.*.*" + type: object + object_type: double + object_type_mapping_type: "*" + description: > + Metrics that returned from Google Cloud API query. + diff --git a/packages/gcp/data_stream/storage/manifest.yml b/packages/gcp/data_stream/storage/manifest.yml new file mode 100644 index 00000000000..fff1d6910a4 --- /dev/null +++ b/packages/gcp/data_stream/storage/manifest.yml @@ -0,0 +1,31 @@ +title: "GCP Storage Metrics" +type: metrics +streams: + - input: gcp/metrics + title: GCP Storage Metrics + description: Collect GCP Storage Metrics + vars: + - name: zone + type: text + title: GCP Zone + multi: false + required: false + show_user: true + - name: region + type: text + title: GCP Region + multi: false + required: false + show_user: true + - name: period + type: text + title: Period + default: 60s + required: true + - name: exclude_labels + type: bool + title: Exclude Labels + description: Exclude additional labels from metrics + multi: false + required: false + show_user: true diff --git a/packages/gcp/data_stream/storage/sample_event.json b/packages/gcp/data_stream/storage/sample_event.json new file mode 100644 index 00000000000..8f06b2469e0 --- /dev/null +++ b/packages/gcp/data_stream/storage/sample_event.json @@ -0,0 +1,52 @@ +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.storage", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "storage": { + "storage": { + "total_bytes": { + "value": 4472520191 + } + }, + "network": { + "received_bytes_count": 0 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "storage", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} \ No newline at end of file diff --git a/packages/gcp/docs/storage.md b/packages/gcp/docs/storage.md new file mode 100644 index 00000000000..95b47115571 --- /dev/null +++ b/packages/gcp/docs/storage.md @@ -0,0 +1,130 @@ +# Storage + +## Metrics + +The `storage` dataset fetches metrics from [Storage](https://cloud.google.com/storage/) in Google Cloud Platform. It contains all metrics exported from the [GCP Storage Monitoring API](https://cloud.google.com/monitoring/api/metrics_gcp#gcp-storage). + +You can specify a single region to fetch metrics like `us-central1`. Be aware that GCP Storage does not use zones so `us-central1-a` will return nothing. If no region is specified, it will return metrics from all buckets. + +## Sample Event + +An example event for `storage` looks as following: + +```json +{ + "@timestamp": "2017-10-12T08:05:34.853Z", + "cloud": { + "account": { + "id": "elastic-obs-integrations-dev", + "name": "elastic-obs-integrations-dev" + }, + "instance": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "machine": { + "type": "e2-medium" + }, + "provider": "gcp", + "availability_zone": "us-central1-c", + "region": "us-central1" + }, + "event": { + "dataset": "gcp.storage", + "duration": 115000, + "module": "gcp" + }, + "gcp": { + "storage": { + "storage": { + "total_bytes": { + "value": 4472520191 + } + }, + "network": { + "received_bytes_count": 0 + } + }, + "labels": { + "user": { + "goog-gke-node": "" + } + } + }, + "host": { + "id": "4751091017865185079", + "name": "gke-cluster-1-default-pool-6617a8aa-5clh" + }, + "metricset": { + "name": "storage", + "period": 10000 + }, + "service": { + "type": "gcp" + } +} +``` + +## Exported fields + +**Exported fields** + +| Field | Description | Type | +|---|---|---| +| @timestamp | Event timestamp. | date | +| cloud | Fields related to the cloud or infrastructure the events are coming from. | group | +| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | +| cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword | +| cloud.availability_zone | Availability zone in which this host is running. | keyword | +| cloud.image.id | Image ID for the cloud instance. | keyword | +| cloud.instance.id | Instance ID of the host machine. | keyword | +| cloud.instance.name | Instance name of the host machine. | keyword | +| cloud.machine.type | Machine type of the host machine. | keyword | +| cloud.project.id | Name of the project in Google Cloud. | keyword | +| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | +| cloud.region | Region in which this host is running. | keyword | +| container.id | Unique container id. | keyword | +| container.image.name | Name of the image the container was built on. | keyword | +| container.labels | Image labels. | object | +| container.name | Container name. | keyword | +| data_stream.dataset | Data stream dataset. | constant_keyword | +| data_stream.namespace | Data stream namespace. | constant_keyword | +| data_stream.type | Data stream type. | constant_keyword | +| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | +| error | These fields can represent errors of any kind. Use them for errors that happen while fetching events or in cases where the event itself contains an error. | group | +| error.message | Error message. | match_only_text | +| event.dataset | Event dataset | constant_keyword | +| event.module | Event module | constant_keyword | +| gcp.labels.metadata.\* | | object | +| gcp.labels.metrics.\* | | object | +| gcp.labels.resource.\* | | object | +| gcp.labels.system.\* | | object | +| gcp.labels.user.\* | | object | +| gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | +| gcp.storage.api.request.count | Delta count of API calls, grouped by the API method name and response code. | long | +| gcp.storage.authz.acl_based_object_access_.ount | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | +| gcp.storage.authz.acl_operations.count | Usage of ACL operations broken down by type. | long | +| gcp.storage.authz.object_specific_acl_mutation.count | Delta count of changes made to object specific ACLs. | long | +| gcp.storage.network.received.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | +| gcp.storage.network.sent.bytes | Delta count of bytes sent over the network, grouped by the API method name and response code. | long | +| gcp.storage.storage.object.count | Total number of objects per bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | +| gcp.storage.storage.total.bytes | Total size of all objects in the bucket, grouped by storage class. This value is measured once per day, and the value is repeated at each sampling interval throughout the day. | long | +| gcp.storage.storage.total_byte_seconds.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | +| host.architecture | Operating system architecture. | keyword | +| host.containerized | If the host is a container. | boolean | +| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | +| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | +| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | +| host.ip | Host ip addresses. | ip | +| host.mac | Host mac addresses. | keyword | +| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | +| host.os.build | OS build information. | keyword | +| host.os.codename | OS codename, if any. | keyword | +| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | +| host.os.kernel | Operating system kernel version as a raw string. | keyword | +| host.os.name | Operating system name, without the version. | keyword | +| host.os.name.text | Multi-field of `host.os.name`. | text | +| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | +| host.os.version | Operating system version as a raw string. | keyword | +| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | +| service.type | The type of the service data is collected from. The type can be used to group and correlate logs and metrics from one service type. Example: If logs or metrics are collected from Elasticsearch, `service.type` would be `elasticsearch`. | keyword | diff --git a/packages/gcp/manifest.yml b/packages/gcp/manifest.yml index 779b9fb75cd..dcf28e28fe8 100644 --- a/packages/gcp/manifest.yml +++ b/packages/gcp/manifest.yml @@ -133,5 +133,15 @@ policy_templates: title: Collect GCP Firestore Metrics description: Collect GCP Firestore Metrics input_group: metrics + - name: storage + title: Google Cloud Platform (GCP) Storage metrics + description: Collect storage metrics from Google Cloud Platform (GCP) with Elastic Agent + data_streams: + - storage + inputs: + - type: gcp/metrics + title: Collect GCP Storage Metrics + description: Collect GCP Storage Metrics + input_group: metrics owner: github: elastic/security-external-integrations From 0693deea2db25cd1241ad970c8a87993014fcc94 Mon Sep 17 00:00:00 2001 From: gab Date: Thu, 21 Jul 2022 15:56:57 +0300 Subject: [PATCH 02/13] fix sample event --- packages/gcp/data_stream/storage/sample_event.json | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/packages/gcp/data_stream/storage/sample_event.json b/packages/gcp/data_stream/storage/sample_event.json index 8f06b2469e0..0b0e8e65ed4 100644 --- a/packages/gcp/data_stream/storage/sample_event.json +++ b/packages/gcp/data_stream/storage/sample_event.json @@ -24,12 +24,14 @@ "gcp": { "storage": { "storage": { - "total_bytes": { - "value": 4472520191 + "total": { + "bytes": 4472520191 } }, "network": { - "received_bytes_count": 0 + "received": { + "bytes": 4472520191 + } } }, "labels": { From e31f36bbb1d265628468b19f9c853fe95bd0bc0c Mon Sep 17 00:00:00 2001 From: gab Date: Thu, 21 Jul 2022 16:09:30 +0300 Subject: [PATCH 03/13] fix storage docs --- packages/gcp/docs/storage.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/packages/gcp/docs/storage.md b/packages/gcp/docs/storage.md index 95b47115571..d104e1cd285 100644 --- a/packages/gcp/docs/storage.md +++ b/packages/gcp/docs/storage.md @@ -37,12 +37,14 @@ An example event for `storage` looks as following: "gcp": { "storage": { "storage": { - "total_bytes": { - "value": 4472520191 + "total": { + "bytes": 4472520191 } }, "network": { - "received_bytes_count": 0 + "received": { + "bytes": 4472520191 + } } }, "labels": { From 53f6c219260ac3d817004c2ade2e40dc6dc715ba Mon Sep 17 00:00:00 2001 From: gab Date: Wed, 3 Aug 2022 22:44:45 +0300 Subject: [PATCH 04/13] target latest changelog version --- packages/gcp/changelog.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/packages/gcp/changelog.yml b/packages/gcp/changelog.yml index c1363c6809d..d1e96881b9b 100644 --- a/packages/gcp/changelog.yml +++ b/packages/gcp/changelog.yml @@ -4,6 +4,9 @@ - description: Remove fields duplicated in ECS fields type: enhancement link: https://github.com/elastic/integrations/pull/3609 + - description: Add GCP Storage Data Stream + type: enhancement + link: https://github.com/elastic/integrations/pull/3785 - version: "2.1.0" changes: - description: restore compatibility with 7.17 release track @@ -32,9 +35,6 @@ - description: Add GCP Firestore Data stream type: enhancement link: https://github.com/elastic/integrations/pull/2704 - - description: Add GCP Storage Data Stream - type: enhancement - link: https://github.com/elastic/integrations/pull/3785 - version: "1.10.0" changes: - description: Update package to ECS 8.3.0. From 215ac40de05c7037c17b51ccd430c35069878a42 Mon Sep 17 00:00:00 2001 From: gab Date: Wed, 17 Aug 2022 22:27:10 +0300 Subject: [PATCH 05/13] bump to 2.7.0 --- packages/gcp/changelog.yml | 8 +++++--- packages/gcp/manifest.yml | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/packages/gcp/changelog.yml b/packages/gcp/changelog.yml index d1e96881b9b..0cb8718977b 100644 --- a/packages/gcp/changelog.yml +++ b/packages/gcp/changelog.yml @@ -1,12 +1,14 @@ # newer versions go on top +- version: "2.7.0" + changes: + - description: Add GCP Storage Data Stream + type: enhancement + link: https://github.com/elastic/integrations/pull/3785 - version: "2.2.0" changes: - description: Remove fields duplicated in ECS fields type: enhancement link: https://github.com/elastic/integrations/pull/3609 - - description: Add GCP Storage Data Stream - type: enhancement - link: https://github.com/elastic/integrations/pull/3785 - version: "2.1.0" changes: - description: restore compatibility with 7.17 release track diff --git a/packages/gcp/manifest.yml b/packages/gcp/manifest.yml index dcf28e28fe8..a6c6373320c 100644 --- a/packages/gcp/manifest.yml +++ b/packages/gcp/manifest.yml @@ -1,6 +1,6 @@ name: gcp title: Google Cloud Platform -version: "2.2.0" +version: "2.7.0" release: ga description: Collect logs from Google Cloud Platform with Elastic Agent. type: integration From efe5ae52340bde54b04fd2228bac9bfa40969bde Mon Sep 17 00:00:00 2001 From: Edoardo Tenani <526307+endorama@users.noreply.github.com> Date: Tue, 23 Aug 2022 10:37:02 +0200 Subject: [PATCH 06/13] Update manifest.yml --- packages/gcp/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/gcp/manifest.yml b/packages/gcp/manifest.yml index a37c1256b3b..f56d4573385 100644 --- a/packages/gcp/manifest.yml +++ b/packages/gcp/manifest.yml @@ -1,6 +1,6 @@ name: gcp title: Google Cloud Platform -version: "2.7.0" +version: "2.6.0" release: ga description: Collect logs from Google Cloud Platform with Elastic Agent. type: integration From 41c69fb5a87290bc1f4f6ddfdef42cf62e4c6e50 Mon Sep 17 00:00:00 2001 From: Edoardo Tenani <526307+endorama@users.noreply.github.com> Date: Tue, 23 Aug 2022 10:37:15 +0200 Subject: [PATCH 07/13] Update changelog.yml --- packages/gcp/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/gcp/changelog.yml b/packages/gcp/changelog.yml index d88e755d068..c4654db4d2b 100644 --- a/packages/gcp/changelog.yml +++ b/packages/gcp/changelog.yml @@ -1,5 +1,5 @@ # newer versions go on top -- version: "2.7.0" +- version: "2.6.0" changes: - description: Add GCP Storage Data Stream type: enhancement From c6ace1e570914b51ece6d571dbdefefd0fe3960d Mon Sep 17 00:00:00 2001 From: Edoardo Tenani Date: Tue, 23 Aug 2022 10:45:27 +0200 Subject: [PATCH 08/13] Revert "Update manifest.yml" This reverts commit efe5ae52340bde54b04fd2228bac9bfa40969bde. Bump to 2.7.0 was correct so this PR can be merged after https://github.com/elastic/integrations/pull/3493 --- packages/gcp/manifest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/gcp/manifest.yml b/packages/gcp/manifest.yml index f56d4573385..a37c1256b3b 100644 --- a/packages/gcp/manifest.yml +++ b/packages/gcp/manifest.yml @@ -1,6 +1,6 @@ name: gcp title: Google Cloud Platform -version: "2.6.0" +version: "2.7.0" release: ga description: Collect logs from Google Cloud Platform with Elastic Agent. type: integration From bcf733d60035d084a5a9b2eaa20bb554e08769eb Mon Sep 17 00:00:00 2001 From: Edoardo Tenani Date: Tue, 23 Aug 2022 10:45:55 +0200 Subject: [PATCH 09/13] Revert "Update changelog.yml" This reverts commit 41c69fb5a87290bc1f4f6ddfdef42cf62e4c6e50. Bump to 2.7.0 was correct so this PR can be merged after https://github.com/elastic/integrations/pull/3493 --- packages/gcp/changelog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/gcp/changelog.yml b/packages/gcp/changelog.yml index c4654db4d2b..d88e755d068 100644 --- a/packages/gcp/changelog.yml +++ b/packages/gcp/changelog.yml @@ -1,5 +1,5 @@ # newer versions go on top -- version: "2.6.0" +- version: "2.7.0" changes: - description: Add GCP Storage Data Stream type: enhancement From 480e2fdd644c24ff758c343064f9589ff1fefd35 Mon Sep 17 00:00:00 2001 From: Edoardo Tenani Date: Tue, 23 Aug 2022 15:23:38 +0200 Subject: [PATCH 10/13] fix broken merge --- packages/gcp/manifest.yml | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/packages/gcp/manifest.yml b/packages/gcp/manifest.yml index eab72f90c7e..3082825965d 100644 --- a/packages/gcp/manifest.yml +++ b/packages/gcp/manifest.yml @@ -157,7 +157,10 @@ policy_templates: title: Collect GCP Load Balancing Metrics description: Collect GCP Load Balancing Metrics input_group: metrics -<<<<<<< HEAD + - type: gcp-pubsub + title: "Collect Google Cloud Platform (GCP) load balancing logs (input: gcp-pubsub)" + description: "Collecting load balancing logs from Google Cloud Platform (GCP) (input: gcp-pubsub)" + input_group: logs - name: storage title: Google Cloud Platform (GCP) Storage metrics description: Collect storage metrics from Google Cloud Platform (GCP) with Elastic Agent @@ -168,11 +171,5 @@ policy_templates: title: Collect GCP Storage Metrics description: Collect GCP Storage Metrics input_group: metrics -======= - - type: gcp-pubsub - title: "Collect Google Cloud Platform (GCP) load balancing logs (input: gcp-pubsub)" - description: "Collecting load balancing logs from Google Cloud Platform (GCP) (input: gcp-pubsub)" - input_group: logs ->>>>>>> origin/main owner: github: elastic/security-external-integrations From e18fa97b292d125bd27dece2bd6ed4f812d36dbf Mon Sep 17 00:00:00 2001 From: Tom Myers <106530686+tommyers-elastic@users.noreply.github.com> Date: Wed, 24 Aug 2022 09:58:33 +0100 Subject: [PATCH 11/13] Fix typo in metric name `authz.acl_based_object_access_.ount` -> `authz.acl_based_object_access_.count` --- packages/gcp/data_stream/storage/fields/fields.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/gcp/data_stream/storage/fields/fields.yml b/packages/gcp/data_stream/storage/fields/fields.yml index e2d6160aa00..5de08e370b2 100644 --- a/packages/gcp/data_stream/storage/fields/fields.yml +++ b/packages/gcp/data_stream/storage/fields/fields.yml @@ -5,7 +5,7 @@ - name: api.request.count type: long description: Delta count of API calls, grouped by the API method name and response code. - - name: authz.acl_based_object_access_.ount + - name: authz.acl_based_object_access_.count type: long description: Delta count of requests that result in an object being granted access solely due to object ACLs. - name: authz.acl_operations.count From b9e94a6b0a2efcafb01dd8c62cfa80883e439b74 Mon Sep 17 00:00:00 2001 From: tommyers-elastic <106530686+tommyers-elastic@users.noreply.github.com> Date: Wed, 24 Aug 2022 10:11:05 +0100 Subject: [PATCH 12/13] update docs with fixed metric name --- packages/gcp/docs/storage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/gcp/docs/storage.md b/packages/gcp/docs/storage.md index d104e1cd285..a0ba57286ef 100644 --- a/packages/gcp/docs/storage.md +++ b/packages/gcp/docs/storage.md @@ -104,7 +104,7 @@ An example event for `storage` looks as following: | gcp.labels.user.\* | | object | | gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | gcp.storage.api.request.count | Delta count of API calls, grouped by the API method name and response code. | long | -| gcp.storage.authz.acl_based_object_access_.ount | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | +| gcp.storage.authz.acl_based_object_access_.count | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | | gcp.storage.authz.acl_operations.count | Usage of ACL operations broken down by type. | long | | gcp.storage.authz.object_specific_acl_mutation.count | Delta count of changes made to object specific ACLs. | long | | gcp.storage.network.received.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long | From cd4d7325fa7a3d6fcb8cbbf46f642e345b7bab34 Mon Sep 17 00:00:00 2001 From: gab Date: Wed, 24 Aug 2022 15:42:07 +0300 Subject: [PATCH 13/13] remove underscore in field --- packages/gcp/data_stream/storage/fields/fields.yml | 2 +- packages/gcp/docs/storage.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/gcp/data_stream/storage/fields/fields.yml b/packages/gcp/data_stream/storage/fields/fields.yml index 5de08e370b2..5e8d4e279be 100644 --- a/packages/gcp/data_stream/storage/fields/fields.yml +++ b/packages/gcp/data_stream/storage/fields/fields.yml @@ -5,7 +5,7 @@ - name: api.request.count type: long description: Delta count of API calls, grouped by the API method name and response code. - - name: authz.acl_based_object_access_.count + - name: authz.acl_based_object_access.count type: long description: Delta count of requests that result in an object being granted access solely due to object ACLs. - name: authz.acl_operations.count diff --git a/packages/gcp/docs/storage.md b/packages/gcp/docs/storage.md index a0ba57286ef..690d821c5b5 100644 --- a/packages/gcp/docs/storage.md +++ b/packages/gcp/docs/storage.md @@ -104,7 +104,7 @@ An example event for `storage` looks as following: | gcp.labels.user.\* | | object | | gcp.metrics.\*.\*.\*.\* | Metrics that returned from Google Cloud API query. | object | | gcp.storage.api.request.count | Delta count of API calls, grouped by the API method name and response code. | long | -| gcp.storage.authz.acl_based_object_access_.count | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | +| gcp.storage.authz.acl_based_object_access.count | Delta count of requests that result in an object being granted access solely due to object ACLs. | long | | gcp.storage.authz.acl_operations.count | Usage of ACL operations broken down by type. | long | | gcp.storage.authz.object_specific_acl_mutation.count | Delta count of changes made to object specific ACLs. | long | | gcp.storage.network.received.bytes | Delta count of bytes received over the network, grouped by the API method name and response code. | long |