(Elasticsearch and filebeat are both v7.2)
I was encountering a lot of difficulty using the convert processor to change types, so I simplified things down to using rename. The results of my tests are confusing.
Given the following config block, I'd expect 6 fields to get renamed:
- module: osquery result: enabled: true input: processors: - rename: fields: - from: "input.type" to: "input.typerenamed" - from: "fileset.name" to: "fileset.renamed" - from: "host.architecture" to: "host.architecturerenamed" - from: "host.os.platform" to: "host.os.platformrenamed" - from: "osquery.result.action" to: "osquery.result.actionrenamed" - from: "osquery.result.columns.actual_rpm" to: "osquery.result.columns.actual_rpmrenamed"
What I actually get is just 2 fields renamed. input.type and fileset.name both successfully change.
None of the other lines work, instead I get errors saying that the fields were not found. The fields are definitely there, and I even copy/pasted the names just in case I was like unable to spell 'columns' or something
I've tried a number of different fields, some rename, others end up with an error.message in this format:
Failed to rename fields in processor: could not fetch value for key: foo, Error: key not found
I see that there is a "dot expander processor" but it implies that any field with a dot in the name can't be manipulated by a processor, but input.type and fileset.name do...