[8.6] Add entity_id mappings to file and network datastreams in endpoint-package

[Omolola-Akinleye]

Change Summary

Add entity_id mappings to file and network datastreams in endpoint-package

Add file and network mappings to enable file/network telemetry for session view feature work.

Sample values

File Sample Value

process.entry_leader.entity_id:"Y2NiN2IxYTEtMzAz"
process.session_leader.entity_id:"Y2NiN2IxYTEtMzAz"
process.group_leader.entity_id:"Y2NiN2IxYTEtMzAz"
process.parent.entity_id:"Y2NiN2IxYTEtMzAz"
process.parent.group_leader.entity_id:"Y2NiN2IxYTEtMzAz"
process.entry_leader.parent.entity_id:"Y2NiN2IxYTEtMzAz"

Network Sample Values

process.entry_leader.entity_id:"YWZkMzQ4Yz=j"
process.session_leader.entity_id:"YWZkMzQ4Yz="
process.group_leader.entity_id:"YWZkMzQ4Yz=j"
process.parent.entity_id:"YWZkMzQ4Yz="
process.parent.group_leader.entity_id:"YWZkMzQ4Yz="
process.entry_leader.parent.entity_id:"YWZkMzQ4Yz="

Sample document:

File Sample Mappings

        "parent":{
           "entity_id": "Y2NiN2IxYTEtMzAz",
           "group_leader": {
                "entity_id": "Y2NiN2IxYTEtMzAz"
            }
        },
        "entry_leader":{
           "entity_id": "Y2NiN2IxYTEtMzAz",
           "group_leader": {
                "entity_id": "Y2NiN2IxYTEtMzAz"
            }
        },
        "session_leader":{
           "entity_id": "Y2NiN2IxYTEtMzAz"
        },
        "group_leader":{
           "entity_id": "Y2NiN2IxYTEtMzAz"
        },

Network Sample Mappings

     "parent": {
            "entity_id": "YWZkMzQ4Yz=",
            "group_leader": {
                "entity_id": "YWZkMzQ4Yz="
            }
        },
        "entry_leader": {
            "entity_id":  "YWZkMzQ4Yz=",
            "parent": {
                "entity_id": "YWZkMzQ4Yz="
            }
        },
        "session_leader": {
            "entity_id":  "YWZkMzQ4Yz="
        },
        "group_leader": {
            "entity_id": "YWZkMzQ4Yz="
        },

Release Target

8.6

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• If this is a metadata change, I also updated both transform destination schemas to match

For Transform changes:

• The new transform successfully starts in Kibana
• The corresponding transform destination schema was updated if necessary

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-10-17T22:20:09.433+0000

• Duration: 7 min 19 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[Omolola-Akinleye]

/test

[mitodrummer]

the file.yaml mappings differ from these. Looks like entry_leader.parent.entity_id and parent.group_leader.entity_id need to be added.

[Omolola-Akinleye]

Nice catch!

[mitodrummer]

LGTM!

[elasticmachine]

Package endpoint - 8.6.0 containing this change is available at https://epr.elastic.co