Merge branch '8.16' into mergify/bp/8.16/pr-6085

elastic · Dec 19, 2024 · b38a013 · b38a013
2 parents 7d0c993 + 650adcf
commit b38a013
Show file tree

Hide file tree

Showing 46 changed files with 2,388 additions and 472 deletions.
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/activemq.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/activemq.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -18,6 +20,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded
@@ -28,6 +32,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           multiline:
             match: after
             negate: true
@@ -40,6 +46,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded
@@ -62,7 +70,6 @@ inputs:
           path: /api/jolokia/?ignoreErrors=true&amp;canonicalNaming=false
           period: ${kubernetes.hints.activemq.broker.period|kubernetes.hints.activemq.period|'10s'}
           tags:
-            - forwarded
             - activemq-broker
           username: ${kubernetes.hints.activemq.broker.username|kubernetes.hints.activemq.username|'admin'}
         - condition: ${kubernetes.hints.activemq.queue.enabled} == true or ${kubernetes.hints.activemq.enabled} == true
@@ -77,7 +84,6 @@ inputs:
           path: /api/jolokia/?ignoreErrors=true&amp;canonicalNaming=false
           period: ${kubernetes.hints.activemq.queue.period|kubernetes.hints.activemq.period|'10s'}
           tags:
-            - forwarded
             - activemq-queue
           username: ${kubernetes.hints.activemq.queue.username|kubernetes.hints.activemq.username|'admin'}
         - condition: ${kubernetes.hints.activemq.topic.enabled} == true or ${kubernetes.hints.activemq.enabled} == true
@@ -92,7 +98,6 @@ inputs:
           path: /api/jolokia/?ignoreErrors=true&amp;canonicalNaming=false
           period: ${kubernetes.hints.activemq.topic.period|kubernetes.hints.activemq.period|'10s'}
           tags:
-            - forwarded
             - activemq-topic
           username: ${kubernetes.hints.activemq.topic.username|kubernetes.hints.activemq.username|'admin'}
       data_stream.namespace: default
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/apache.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/apache.yml
@@ -1,46 +1,4 @@
 inputs:
-    - name: filestream-apache
-      id: filestream-apache-${kubernetes.hints.container_id}
-      type: filestream
-      use_output: default
-      streams:
-        - condition: ${kubernetes.hints.apache.access.enabled} == true or ${kubernetes.hints.apache.enabled} == true
-          data_stream:
-            dataset: apache.access
-            type: logs
-          exclude_files:
-            - .gz$
-          parsers:
-            - container:
-                format: auto
-                stream: ${kubernetes.hints.apache.access.stream|'all'}
-          paths:
-            - /var/log/containers/*${kubernetes.hints.container_id}.log
-          prospector:
-            scanner:
-                symlinks: true
-          tags:
-            - apache-access
-        - condition: ${kubernetes.hints.apache.error.enabled} == true or ${kubernetes.hints.apache.enabled} == true
-          data_stream:
-            dataset: apache.error
-            type: logs
-          exclude_files:
-            - .gz$
-          parsers:
-            - container:
-                format: auto
-                stream: ${kubernetes.hints.apache.error.stream|'all'}
-          paths:
-            - /var/log/containers/*${kubernetes.hints.container_id}.log
-          processors:
-            - add_locale: null
-          prospector:
-            scanner:
-                symlinks: true
-          tags:
-            - apache-error
-      data_stream.namespace: default
     - name: httpjson-apache
       id: httpjson-apache-${kubernetes.hints.container_id}
       type: httpjson
@@ -139,3 +97,53 @@ inputs:
           period: ${kubernetes.hints.apache.status.period|kubernetes.hints.apache.period|'30s'}
           server_status_path: /server-status
       data_stream.namespace: default
+    - name: filestream-apache
+      id: filestream-apache-${kubernetes.hints.container_id}
+      type: filestream
+      use_output: default
+      streams:
+        - condition: ${kubernetes.hints.apache.access.enabled} == true or ${kubernetes.hints.apache.enabled} == true
+          data_stream:
+            dataset: apache.access
+            type: logs
+          exclude_files:
+            - .gz$
+          file_identity:
+            fingerprint: null
+          parsers:
+            - container:
+                format: auto
+                stream: ${kubernetes.hints.apache.access.stream|'all'}
+          paths:
+            - /var/log/containers/*${kubernetes.hints.container_id}.log
+          prospector:
+            scanner:
+                fingerprint:
+                    enabled: true
+                symlinks: true
+          tags:
+            - apache-access
+        - condition: ${kubernetes.hints.apache.error.enabled} == true or ${kubernetes.hints.apache.enabled} == true
+          data_stream:
+            dataset: apache.error
+            type: logs
+          exclude_files:
+            - .gz$
+          file_identity:
+            fingerprint: null
+          parsers:
+            - container:
+                format: auto
+                stream: ${kubernetes.hints.apache.error.stream|'all'}
+          paths:
+            - /var/log/containers/*${kubernetes.hints.container_id}.log
+          processors:
+            - add_locale: null
+          prospector:
+            scanner:
+                fingerprint:
+                    enabled: true
+                symlinks: true
+          tags:
+            - apache-error
+      data_stream.namespace: default
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/cassandra.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/cassandra.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           multiline:
             match: after
             negate: true
@@ -22,6 +24,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded

diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/cef.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/cef.yml
@@ -1,25 +1,4 @@
 inputs:
-    - name: udp-cef
-      id: udp-cef-${kubernetes.hints.container_id}
-      type: udp
-      use_output: default
-      streams:
-        - condition: ${kubernetes.hints.cef.log.enabled} == true or ${kubernetes.hints.cef.enabled} == true
-          data_stream:
-            dataset: cef.log
-            type: logs
-          host: localhost:9003
-          processors:
-            - rename:
-                fields:
-                    - from: message
-                      to: event.original
-            - decode_cef:
-                field: event.original
-          tags:
-            - cef
-            - forwarded
-      data_stream.namespace: default
     - name: tcp-cef
       id: tcp-cef-${kubernetes.hints.container_id}
       type: tcp
@@ -52,6 +31,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -67,8 +48,31 @@ inputs:
                 field: event.original
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - cef
             - forwarded
       data_stream.namespace: default
+    - name: udp-cef
+      id: udp-cef-${kubernetes.hints.container_id}
+      type: udp
+      use_output: default
+      streams:
+        - condition: ${kubernetes.hints.cef.log.enabled} == true or ${kubernetes.hints.cef.enabled} == true
+          data_stream:
+            dataset: cef.log
+            type: logs
+          host: localhost:9003
+          processors:
+            - rename:
+                fields:
+                    - from: message
+                      to: event.original
+            - decode_cef:
+                field: event.original
+          tags:
+            - cef
+            - forwarded
+      data_stream.namespace: default
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/checkpoint.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/checkpoint.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -30,6 +32,8 @@ inputs:
                 target: _temp_
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded

diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/crowdstrike.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/crowdstrike.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           multiline.match: after
           multiline.max_lines: 5000
           multiline.negate: true
@@ -23,6 +25,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded
@@ -33,6 +37,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -43,6 +49,8 @@ inputs:
             - add_locale: null
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded

diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/cyberarkpas.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/cyberarkpas.yml
@@ -44,6 +44,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -54,6 +56,8 @@ inputs:
             - add_locale: null
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded