Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Winlogbeat] Routing pipeline doesn't match powershell events #31287

Closed
andrewkroh opened this issue Apr 13, 2022 · 1 comment · Fixed by #31291
Closed

[Winlogbeat] Routing pipeline doesn't match powershell events #31287

andrewkroh opened this issue Apr 13, 2022 · 1 comment · Fixed by #31291
Assignees
@efd6
Labels
bug Winlogbeat

Comments

@andrewkroh
Copy link
Member

The 8.x Winlogbeat routing pipeline does not match the Windows PowerShell channel name. The s in shell needs capitalized.

beats/x-pack/winlogbeat/module/routing/ingest/routing.yml

Line 12 in 5478d73

if: ctx?.winlog?.channel == 'Windows Powershell'

beats/x-pack/winlogbeat/module/powershell/test/testdata/400.evtx.golden.json

Line 47 in 5478d73

"channel": "Windows PowerShell",

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Apr 13, 2022
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Apr 13, 2022
@efd6 efd6 self-assigned this Apr 13, 2022
@efd6 efd6 mentioned this issue Apr 13, 2022
Merged
6 tasks
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@efd6 efd6

Labels
bug Winlogbeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

x-pack/winlogbeat/module/routing/ingest: fix typo for channel name efd6/beats
3 participants
@andrewkroh @elasticmachine @efd6