From 152fdaa7bb4f826329244172ca8ec4e93cb32ed1 Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Tue, 15 Apr 2025 11:40:43 -0400 Subject: [PATCH 1/2] Support Kratos user.name lookup --- .../grid-nodes_general/kratos-logs.json | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) rename salt/elasticfleet/files/{integrations => integrations-dynamic}/grid-nodes_general/kratos-logs.json (52%) diff --git a/salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json similarity index 52% rename from salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json rename to salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json index 6a67c9c1c..5ae81ba83 100644 --- a/salt/elasticfleet/files/integrations/grid-nodes_general/kratos-logs.json +++ b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json @@ -1,3 +1,4 @@ +{% set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') %} { "package": { "name": "log", @@ -19,7 +20,7 @@ ], "data_stream.dataset": "kratos", "tags": ["so-kratos"], - "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true \n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos", + "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos\n- if:\n has_fields:\n - identity_id\n then:{% for id, email in identities %}\n - if:\n equals:\n identity_id: \"{{ id }}\"\n then:\n - add_fields:\n target: ''\n fields:\n user.name: \"{{ email }}\"{% endfor %}", "custom": "pipeline: kratos" } } @@ -28,3 +29,4 @@ }, "force": true } + From 5fd7bf311d2310512b0d2fbac051c4a8b5a73e7e Mon Sep 17 00:00:00 2001 From: Josh Brower Date: Tue, 15 Apr 2025 13:57:55 -0400 Subject: [PATCH 2/2] Add fallback --- .../grid-nodes_general/kratos-logs.json | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json index 5ae81ba83..f6b01cdff 100644 --- a/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json +++ b/salt/elasticfleet/files/integrations-dynamic/grid-nodes_general/kratos-logs.json @@ -1,4 +1,14 @@ -{% set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') %} +{%- set identities = salt['sqlite3.fetch']('/nsm/kratos/db/db.sqlite', 'SELECT id, json_extract(traits, "$.email") as email FROM identities;') -%} +{%- set valid_identities = false -%} +{%- if identities -%} + {%- set valid_identities = true -%} + {%- for id, email in identities -%} + {%- if not id or not email -%} + {%- set valid_identities = false -%} + {%- break -%} + {%- endif -%} + {%- endfor -%} +{%- endif -%} { "package": { "name": "log", @@ -20,7 +30,11 @@ ], "data_stream.dataset": "kratos", "tags": ["so-kratos"], + {%- if valid_identities -%} "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos\n- if:\n has_fields:\n - identity_id\n then:{% for id, email in identities %}\n - if:\n equals:\n identity_id: \"{{ id }}\"\n then:\n - add_fields:\n target: ''\n fields:\n user.name: \"{{ email }}\"{% endfor %}", + {%- else -%} + "processors": "- decode_json_fields:\n fields: [\"message\"]\n target: \"\"\n add_error_key: true\n- add_fields:\n target: event\n fields:\n category: iam\n module: kratos", + {%- endif -%} "custom": "pipeline: kratos" } }