Thanks to visit codestin.com
Credit goes to github.com

Skip to content

slack: add audit.context.session_id#6193

Merged
efd6 merged 1 commit into
elastic:mainfrom
efd6:6189-slack
May 18, 2023
Merged

slack: add audit.context.session_id#6193
efd6 merged 1 commit into
elastic:mainfrom
efd6:6189-slack

Conversation

@efd6
Copy link
Copy Markdown
Contributor

@efd6 efd6 commented May 14, 2023 •
edited
Loading

What does this PR do?

Adds handling of the audit context session_id field used to uniquely identify sessions.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 added enhancement New feature or request Team:Security-External Integrations Integration:slack Slack Logs (Community supported) labels May 14, 2023
@efd6 efd6 self-assigned this May 14, 2023
@efd6 efd6 force-pushed the 6189-slack branch 2 times, most recently from d532da8 to 8952d37 Compare May 14, 2023 23:57
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented May 14, 2023 •
edited
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-05-16T21:51:47.133+0000

  • Duration: 14 min 31 sec

Test stats 🧪

Test Results
Failed 0
Passed 5
Skipped 0
Total 5

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine
Copy link
Copy Markdown

elasticmachine commented May 15, 2023 •
edited
Loading

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (1/1) 💚
Files 100.0% (1/1) 💚 2.983
Classes 100.0% (1/1) 💚 2.983
Methods 100.0% (14/14) 💚 8.238
Lines 98.619% (357/362) 👍 6.577
Conditionals 100.0% (0/0) 💚

@efd6 efd6 marked this pull request as ready for review May 15, 2023 00:21
@efd6 efd6 requested a review from a team as a code owner May 15, 2023 00:21
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented May 15, 2023

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

christophercutajar
christophercutajar reviewed May 15, 2023
View reviewed changes
Comment thread packages/slack/data_stream/audit/fields/fields.yml Outdated
@SpencerLN
Copy link
Copy Markdown
Contributor

SpencerLN commented May 16, 2023

I'm wondering if session_id might make more sense as a keyword instead of a long. I envision it being used for exact match term queries and being aggregated, but it seems unlikely to ever be used with range queries or mathematic operations that a long would be required for.

@efd6
Copy link
Copy Markdown
Contributor Author

efd6 commented May 16, 2023 •
edited
Loading

Yeah, conventionally ID are keywords. Is there any indication that session_ids are assigned contiguously, if that were true, then keeping as long might provide some benefit, otherwise I'll change to a keyword. Let me know.

@SpencerLN
Copy link
Copy Markdown
Contributor

SpencerLN commented May 16, 2023

I've looked through our logs, and I don't see any obvious pattern that would indicate that session_ids are contiguous or not otherwise random.

ebeahan
ebeahan approved these changes May 18, 2023
View reviewed changes
Copy link
Copy Markdown
Member

@ebeahan ebeahan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@efd6 efd6 merged commit 248dabb into elastic:main May 18, 2023
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented May 18, 2023

Package slack - 1.3.0 containing this change is available at https://epr.elastic.co/search?package=slack

@efd6 efd6 deleted the 6189-slack branch February 5, 2025 22:05
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@efd6
slack: add audit.context.session_id (elastic#6193)
ff1515e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@christophercutajar christophercutajar christophercutajar left review comments

@ebeahan ebeahan ebeahan approved these changes

Assignees

@efd6 efd6

Labels

enhancement New feature or request Integration:slack Slack Logs (Community supported)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Slack] session_id Not Parsed

5 participants

@efd6 @elasticmachine @SpencerLN @ebeahan @christophercutajar