PANW schema bugs take 2

[willemdh]

Hello,

Could someone please take a look at:

Panw Schema Bugs in Bytes Sent/Received and Packets Sent/Received

There are some inconsistencies in the way the bytes sent/received and packets sent/received are being mapped in the panw module for filebeat. According to ECS the traditional "bytes_sent" would be mapped to "client.bytes" and/or "source.bytes", and "bytes_received" would be mapped to "server.bytes" and/or "destination.bytes". "packets_sent" would be mapped to "client.packets" and/or "source.packets", and "packets_received" would be mapped to "server.packets" and/or "destination.packets". This is…

And confirm this is a bug?

This is generating confusion.... As source.bytes and destination.bytes are quite important field in a very important dataset, this should be handled asap imho.....

Grtz

Willem

[willemdh]

@andrewkroh Thanks for taking action on this. Please have a look at my comment on event.end in https://github.com/elastic/beats/pull/18525