I want drop field in checkpoint filebeat module. I try write in "filelds" rule_name and rule.name and prefix it "checkpoint" but it doesn't work. Please somebody help me.
filebeat.yml
processors:
- drop_fields:
fields: [ "rule_name" ]
logfile
{"log.level":"debug","@timestamp":"2023-12-19T13:58:52.194Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":136},"message":"Fail to apply processor global{drop_fields={\"Fields\":[\"rule_name\"],\"RegexpFields\":[],\"IgnoreMissing\":false}}: failed to drop field [rule_name], error: key not found","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2023-12-19T13:58:52.195Z","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":213},"message":"Publish event: {\n \"@timestamp\": \"2023-12-19T13:58:52.194Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.11.3\",\n \"truncated\": false,\n \"pipeline\": \"filebeat-8.11.3-checkpoint-firewall-pipeline\"\n },\n \"agent\": {\n \"type\": \"filebeat\",\n \"version\": \"8.11.3\",\n \"ephemeral_id\": \"fdb63023-be42-417c-81ab-68fc7ef43f3c\",\n \"id\": \"781eb65e-e468-45cd-9d6d-2473c69d334b\",\n \"name\": \"rsyslog-server\"\n },\n \"message\": \"<134>1 2023-12-19T13:58:50Z FWM CheckPoint 14102 - [action:\\\"Accept\\\"; conn_direction:\\\"Internal\\\"; flags:\\\"4606214\\\"; ifdir:\\\"inbound\\\"; ifname:\\\"eth3-01.121\\\"; logid:\\\"0\\\"; loguid:\\\"{0x20712d84,0xd822359e,0xe4142bc1,0x17e8a7a6}\\\"; origin:\\\"192.168.11.2\\\"; originsicname:\\\"CN=fw-a,O=FWM..739ad9\\\"; sequencenum:\\\"989\\\"; time:\\\"1702994330\\\"; version:\\\"5\\\"; __policy_id_tag:\\\"product=VPN-1 & FireWall-1[db_tag={001C300F-01DD-0448-8647-09601F173D30};mgmt=FWM;date=1702974939;policy_name=Emperia\\\\]\\\"; dst:\\\"10.20.57.121\\\"; log_delay:\\\"1702994330\\\"; layer_name:\\\"Emperia Security\\\"; layer_name:\\\"App_URL\\\"; layer_uuid:\\\"563d79c2-6291-4eff-b1b5-e2568fd9858c\\\"; layer_uuid:\\\"6e30b814-3cee-4e04-8f07-6812e20b9c7c\\\"; match_id:\\\"26\\\"; match_id:\\\"33554431\\\"; parent_rule:\\\"0\\\"; parent_rule:\\\"0\\\"; rule_action:\\\"Accept\\\"; rule_action:\\\"Accept\\\"; rule_name:\\\"Implicit Cleanup\\\"; rule_uid:\\\"d6885c0c-3bcf-4aee-8d8d-68901511bd3f\\\"; product:\\\"VPN-1 & FireWall-1\\\"; proto:\\\"6\\\"; s_port:\\\"52788\\\"; service:\\\"10050\\\"; service_id:\\\"tcp_10050\\\"; src:\\\"10.10.11.155\\\"]\\n\",\n \"event\": {\n \"module\": \"checkpoint\",\n \"timezone\": \"+00:00\",\n \"dataset\": \"checkpoint.firewall\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"service\": {\n \"type\": \"checkpoint\"\n },\n \"input\": {\n \"type\": \"udp\"\n },\n \"log\": {\n \"source\": {\n \"address\": \"192.168.11.10:57393\"\n }\n },\n \"tags\": [\n \"checkpoint-firewall\",\n \"forwarded\"\n ],\n \"fileset\": {\n \"name\": \"firewall\"\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}
JSON in elasticsearch
{
"_index": "checkpoint-fw-2023.12.19",
"_type": "_doc",
"_id": "diNfgowBRSiKqRmmz5Bc",
"_score": 1,
"_source": {
"checkpoint": {
"conn_direction": "Internal",
"rule_action": [
"Accept",
"Accept"
],
"match_id": [
"26",
"33554431"
],
"parent_rule": [
"0",
"0"
],
"log_delay": "1702994330",
"logid": "0"
},
"server": {
"port": 10050,
"ip": "10.20.57.121"
},
"agent": {
"name": "rsyslog-server",
"id": "781eb65e-e468-45cd-9d6d-2473c69d334b",
"type": "filebeat",
"ephemeral_id": "fdb63023-be42-417c-81ab-68fc7ef43f3c",
"version": "8.11.3"
},
"log": {
"source": {
"address": "192.168.11.10:57393"
}
},
"destination": {
"port": 10050,
"ip": "10.20.57.121"
},
"rule": {
"name": "Implicit Cleanup",
"uuid": "d6885c0c-3bcf-4aee-8d8d-68901511bd3f"
},
"source": {
"port": 52788,
"ip": "10.10.11.155"
},
"network": {
"application": "tcp_10050",
"name": [
"Emperia Security",
"App_URL"
],
"transport": "tcp",
"iana_number": "6",
"direction": "inbound"
},
"observer": {
"ingress": {
"interface": {
"name": "eth3-01.121"
}
},
"product": "VPN-1 & FireWall-1",
"vendor": "Checkpoint",
"name": "192.168.11.2",
"type": "firewall"
},
"ecs": {
"version": "8.0.0"
},
"related": {
"ip": [
"10.10.11.155",
"10.20.57.121"
]
},
"client": {
"port": 52788,
"ip": "10.10.11.155"
},
"event": {
"sequence": 989,
"ingested": "2023-12-19T13:59:26.16440153Z",
"timezone": "UTC",
"created": "2023-12-19T13:58:52.194Z",
"kind": "event",
"module": "checkpoint",
"action": "Accept",
"id": "{0x20712d84,0xd822359e,0xe4142bc1,0x17e8a7a6}",
"category": [
"network"
],
"dataset": "checkpoint.firewall"
},
"fileset": {
"name": "firewall"
},
"tags": [
"checkpoint-firewall",
"forwarded"
],
"input": {
"type": "udp"
},
"@timestamp": "2023-12-19T13:58:50.000Z",
"service": {
"type": "checkpoint"
}
},
"fields": {
"agent.version.keyword": [
"8.11.3"
],
"rule.uuid.keyword": [
"d6885c0c-3bcf-4aee-8d8d-68901511bd3f"
],
"event.category": [
"network"
],
"checkpoint.rule_action": [
"Accept",
"Accept"
],
"server.ip.keyword": [
"10.20.57.121"
],
"event.category.keyword": [
"network"
],
"event.dataset.keyword": [
"checkpoint.firewall"
],
"server.ip": [
"10.20.57.121"
],
"observer.ingress.interface.name": [
"eth3-01.121"
],
"observer.type.keyword": [
"firewall"
],
"service.type": [
"checkpoint"
],
"observer.vendor": [
"Checkpoint"
],
"ecs.version.keyword": [
"8.0.0"
],
"related.ip.keyword": [
"10.10.11.155",
"10.20.57.121"
],
"event.kind.keyword": [
"event"
],
"source.ip": [
"10.10.11.155"
],
"event.action.keyword": [
"Accept"
],
"agent.name": [
"rsyslog-server"
],
"event.kind": [
"event"
],
"rule.name.keyword": [
"Implicit Cleanup"
],
"rule.name": [
"Implicit Cleanup"
],
"checkpoint.logid.keyword": [
"0"
],
"agent.id.keyword": [
"781eb65e-e468-45cd-9d6d-2473c69d334b"
],
"fileset.name": [
"firewall"
],
"input.type": [
"udp"
],
"client.ip": [
"10.10.11.155"
],
"network.iana_number.keyword": [
"6"
],
"tags": [
"checkpoint-firewall",
"forwarded"
],
"checkpoint.parent_rule": [
"0",
"0"
],
"fileset.name.keyword": [
"firewall"
],
"destination.ip.keyword": [
"10.20.57.121"
],
"event.id.keyword": [
"{0x20712d84,0xd822359e,0xe4142bc1,0x17e8a7a6}"
],
"source.port": [
52788
],
"agent.id": [
"781eb65e-e468-45cd-9d6d-2473c69d334b"
],
"client.port": [
52788
],
"ecs.version": [
"8.0.0"
],
"observer.type": [
"firewall"
],
"log.source.address": [
"192.168.11.10:57393"
],
"event.created": [
"2023-12-19T13:58:52.194Z"
],
"event.module.keyword": [
"checkpoint"
],
"network.iana_number": [
"6"
],
"agent.version": [
"8.11.3"
],
"observer.product.keyword": [
"VPN-1 & FireWall-1"
],
"source.ip.keyword": [
"10.10.11.155"
],
"client.ip.keyword": [
"10.10.11.155"
],
"checkpoint.match_id.keyword": [
"26",
"33554431"
],
"event.timezone.keyword": [
"UTC"
],
"observer.vendor.keyword": [
"Checkpoint"
],
"service.type.keyword": [
"checkpoint"
],
"input.type.keyword": [
"udp"
],
"destination.port": [
10050
],
"observer.name": [
"192.168.11.2"
],
"tags.keyword": [
"checkpoint-firewall",
"forwarded"
],
"checkpoint.conn_direction": [
"Internal"
],
"checkpoint.log_delay.keyword": [
"1702994330"
],
"event.sequence": [
989
],
"checkpoint.logid": [
"0"
],
"agent.type": [
"filebeat"
],
"observer.name.keyword": [
"192.168.11.2"
],
"checkpoint.parent_rule.keyword": [
"0",
"0"
],
"checkpoint.rule_action.keyword": [
"Accept",
"Accept"
],
"event.module": [
"checkpoint"
],
"checkpoint.conn_direction.keyword": [
"Internal"
],
"related.ip": [
"10.10.11.155",
"10.20.57.121"
],
"network.application": [
"tcp_10050"
],
"network.application.keyword": [
"tcp_10050"
],
"server.port": [
10050
],
"observer.product": [
"VPN-1 & FireWall-1"
],
"network.direction": [
"inbound"
],
"event.timezone": [
"UTC"
],
"agent.type.keyword": [
"filebeat"
],
"network.direction.keyword": [
"inbound"
],
"agent.ephemeral_id.keyword": [
"fdb63023-be42-417c-81ab-68fc7ef43f3c"
],
"checkpoint.log_delay": [
"1702994330"
],
"agent.name.keyword": [
"rsyslog-server"
],
"network.name": [
"Emperia Security",
"App_URL"
],
"network.transport.keyword": [
"tcp"
],
"destination.ip": [
"10.20.57.121"
],
"network.transport": [
"tcp"
],
"observer.ingress.interface.name.keyword": [
"eth3-01.121"
],
"rule.uuid": [
"d6885c0c-3bcf-4aee-8d8d-68901511bd3f"
],
"event.ingested": [
"2023-12-19T13:59:26.164Z"
],
"event.action": [
"Accept"
],
"checkpoint.match_id": [
"26",
"33554431"
],
"@timestamp": [
"2023-12-19T13:58:50.000Z"
],
"network.name.keyword": [
"Emperia Security",
"App_URL"
],
"agent.ephemeral_id": [
"fdb63023-be42-417c-81ab-68fc7ef43f3c"
],
"log.source.address.keyword": [
"192.168.11.10:57393"
],
"event.id": [
"{0x20712d84,0xd822359e,0xe4142bc1,0x17e8a7a6}"
],
"event.dataset": [
"checkpoint.firewall"
]
}
}