Skip to content

Commit b47bffb

Browse files
aleksmausaleksmaus
authored
EQL: consistent naming for event type vs event category (#53073) (#53090)
Related to #52941
1 parent e180e27 commit b47bffb

34 files changed

+193
-123
lines changed

‎client/rest-high-level/src/main/java/org/elasticsearch/client/eql/EqlSearchRequest.java

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -37,16 +37,16 @@ public class EqlSearchRequest implements Validatable, ToXContentObject {
3737
private IndicesOptions indicesOptions = IndicesOptions.fromOptions(false, false, true, false);
3838

3939
private QueryBuilder filter = null;
40-
private String timestampField = "timestamp";
41-
private String eventTypeField = "event_type";
40+
private String timestampField = "@timestamp";
41+
private String eventCategoryField = "event.category";
4242
private String implicitJoinKeyField = "agent.id";
4343
private int fetchSize = 50;
4444
private SearchAfterBuilder searchAfterBuilder;
4545
private String query;
4646

4747
static final String KEY_FILTER = "filter";
4848
static final String KEY_TIMESTAMP_FIELD = "timestamp_field";
49-
static final String KEY_EVENT_TYPE_FIELD = "event_type_field";
49+
static final String KEY_EVENT_CATEGORY_FIELD = "event_category_field";
5050
static final String KEY_IMPLICIT_JOIN_KEY_FIELD = "implicit_join_key_field";
5151
static final String KEY_SIZE = "size";
5252
static final String KEY_SEARCH_AFTER = "search_after";
@@ -64,7 +64,7 @@ public XContentBuilder toXContent(XContentBuilder builder, ToXContent.Params par
6464
builder.field(KEY_FILTER, filter);
6565
}
6666
builder.field(KEY_TIMESTAMP_FIELD, timestampField());
67-
builder.field(KEY_EVENT_TYPE_FIELD, eventTypeField());
67+
builder.field(KEY_EVENT_CATEGORY_FIELD, eventCategoryField());
6868
if (implicitJoinKeyField != null) {
6969
builder.field(KEY_IMPLICIT_JOIN_KEY_FIELD, implicitJoinKeyField());
7070
}
@@ -107,13 +107,13 @@ public EqlSearchRequest timestampField(String timestampField) {
107107
return this;
108108
}
109109

110-
public String eventTypeField() {
111-
return this.eventTypeField;
110+
public String eventCategoryField() {
111+
return this.eventCategoryField;
112112
}
113113

114-
public EqlSearchRequest eventTypeField(String eventTypeField) {
115-
Objects.requireNonNull(eventTypeField, "event type field must not be null");
116-
this.eventTypeField = eventTypeField;
114+
public EqlSearchRequest eventCategoryField(String eventCategoryField) {
115+
Objects.requireNonNull(eventCategoryField, "event category field must not be null");
116+
this.eventCategoryField = eventCategoryField;
117117
return this;
118118
}
119119

@@ -180,7 +180,7 @@ public boolean equals(Object o) {
180180
Objects.equals(indicesOptions, that.indicesOptions) &&
181181
Objects.equals(filter, that.filter) &&
182182
Objects.equals(timestampField, that.timestampField) &&
183-
Objects.equals(eventTypeField, that.eventTypeField) &&
183+
Objects.equals(eventCategoryField, that.eventCategoryField) &&
184184
Objects.equals(implicitJoinKeyField, that.implicitJoinKeyField) &&
185185
Objects.equals(searchAfterBuilder, that.searchAfterBuilder) &&
186186
Objects.equals(query, that.query);
@@ -194,7 +194,7 @@ public int hashCode() {
194194
filter,
195195
fetchSize,
196196
timestampField,
197-
eventTypeField,
197+
eventCategoryField,
198198
implicitJoinKeyField,
199199
searchAfterBuilder,
200200
query);

‎client/rest-high-level/src/test/java/org/elasticsearch/client/EqlIT.java

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,14 +42,16 @@ public void setupRemoteClusterConfig() throws Exception {
4242
public void testBasicSearch() throws Exception {
4343
Request doc1 = new Request(HttpPut.METHOD_NAME, "/index/_doc/1");
4444
doc1.setJsonEntity("{\"event_subtype_full\": \"already_running\", " +
45-
"\"event_type\": \"process\", " +
45+
"\"event\": {" +
46+
"\"category\": \"process\"" +
47+
"}," +
4648
"\"event_type_full\": \"process_event\", " +
4749
"\"opcode\": 3," +
4850
"\"pid\": 0," +
4951
"\"process_name\": \"System Idle Process\"," +
5052
"\"serial_event_id\": 1," +
5153
"\"subtype\": \"create\"," +
52-
"\"timestamp\": 116444736000000000," +
54+
"\"@timestamp\": 116444736000000000," +
5355
"\"unique_pid\": 1}");
5456
client().performRequest(doc1);
5557
client().performRequest(new Request(HttpPost.METHOD_NAME, "/_refresh"));
@@ -78,8 +80,8 @@ public void testLargeMapping() throws Exception {
7880
sb.append("\"datetime" + i + "\":\"" + now + "\"");
7981
sb.append(",");
8082
}
81-
sb.append("\"event_type\": \"process\",");
82-
sb.append("\"timestamp\": \"2020-02-03T12:34:56Z\",");
83+
sb.append("\"event\": {\"category\": \"process\"},");
84+
sb.append("\"@timestamp\": \"2020-02-03T12:34:56Z\",");
8385
sb.append("\"serial_event_id\": 1");
8486
sb.append("}");
8587
doc1.setJsonEntity(sb.toString());

‎client/rest-high-level/src/test/java/org/elasticsearch/client/eql/EqlSearchRequestTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ protected EqlSearchRequest createClientTestInstance() {
4343
EqlSearchRequest.implicitJoinKeyField(randomAlphaOfLength(10));
4444
}
4545
if (randomBoolean()) {
46-
EqlSearchRequest.eventTypeField(randomAlphaOfLength(10));
46+
EqlSearchRequest.eventCategoryField(randomAlphaOfLength(10));
4747
}
4848
if (randomBoolean()) {
4949
EqlSearchRequest.query(randomAlphaOfLength(10));
@@ -72,7 +72,7 @@ protected org.elasticsearch.xpack.eql.action.EqlSearchRequest doParseToServerIns
7272
@Override
7373
protected void assertInstances(org.elasticsearch.xpack.eql.action.EqlSearchRequest serverInstance, EqlSearchRequest
7474
clientTestInstance) {
75-
assertThat(serverInstance.eventTypeField(), equalTo(clientTestInstance.eventTypeField()));
75+
assertThat(serverInstance.eventCategoryField(), equalTo(clientTestInstance.eventCategoryField()));
7676
assertThat(serverInstance.implicitJoinKeyField(), equalTo(clientTestInstance.implicitJoinKeyField()));
7777
assertThat(serverInstance.timestampField(), equalTo(clientTestInstance.timestampField()));
7878
assertThat(serverInstance.filter(), equalTo(clientTestInstance.filter()));

‎docs/reference/eql/search.asciidoc

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ specified in the `query` parameter. The EQL query matches events with an
3535
----
3636
GET sec_logs/_eql/search
3737
{
38-
"event_type_field": "event.category",
38+
"event_category_field": "event.category",
3939
"timestamp_field": "@timestamp",
4040
"query": """
4141
process where process.name == "cmd.exe"
@@ -89,9 +89,9 @@ The API returns the following response containing the matching event:
8989
[[eql-search-specify-event-type-field]]
9090
=== Specify an event type field
9191

92-
The EQL search API uses `event_type` as the required <<eql-required-fields,event
93-
type field>> by default. You can use the `event_type_field` parameter to specify
94-
another event type field.
92+
The EQL search API uses `event.category` as the required <<eql-required-fields,event
93+
category field>> by default. You can use the `event_category_field` parameter to specify
94+
another event category field.
9595

9696
For example, the following request specifies `file.type` as the event type
9797
field.
@@ -100,7 +100,7 @@ field.
100100
----
101101
GET sec_logs/_eql/search
102102
{
103-
"event_type_field": "file.type",
103+
"event_category_field": "file.type",
104104
"timestamp_field": "@timestamp",
105105
"query": """
106106
file where agent.id == "8a4f500d"
@@ -124,7 +124,7 @@ timestamp field.
124124
GET sec_logs/_eql/search
125125
{
126126
"timestamp_field": "file.accessed",
127-
"event_type_field": "event.category",
127+
"event_category_field": "event.category",
128128
"query": """
129129
file where (file.size > 1 and file.type == "file")
130130
"""
@@ -148,7 +148,7 @@ filtered documents.
148148
----
149149
GET sec_logs/_eql/search
150150
{
151-
"event_type_field": "event.category",
151+
"event_category_field": "event.category",
152152
"timestamp_field": "@timestamp",
153153
"filter": {
154154
"range" : {

‎docs/reference/eql/syntax.asciidoc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ EQL queries require an event type and a matching condition. The `where` keyword
1818

1919
[source,eql]
2020
----
21-
event_type where condition
21+
event.category where condition
2222
----
2323

2424
For example, the following EQL query matches `process` events with a `process.name`

‎x-pack/plugin/eql/qa/common/src/main/java/org/elasticsearch/test/eql/CommonEqlRestTestCase.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,8 +46,8 @@ static class SearchTestConfiguration {
4646
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"\"}", 400, "query is null or empty"));
4747
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"timestamp_field\": \"\"}",
4848
400, "timestamp field is null or empty"));
49-
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"event_type_field\": \"\"}",
50-
400, "event type field is null or empty"));
49+
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"event_category_field\": \"\"}",
50+
400, "event category field is null or empty"));
5151
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"implicit_join_key_field\": \"\"}",
5252
400, "implicit join key field is null or empty"));
5353
searchValidationTests.add(new SearchTestConfiguration("{\"query\": \"" + validQuery + "\", \"size\": 0}",

‎x-pack/plugin/eql/qa/rest/src/test/resources/rest-api-spec/test/eql/10_basic.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,9 @@ setup:
77
- index:
88
_index: eql_test
99
_id: 1
10-
- event_type: process
11-
timestamp: 2020-02-03T12:34:56Z
10+
- event:
11+
- category: process
12+
"@timestamp": 2020-02-03T12:34:56Z
1213
user: SYSTEM
1314

1415
---

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequest.java

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@
2727

2828
import static org.elasticsearch.action.ValidateActions.addValidationError;
2929
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FETCH_SIZE;
30-
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_EVENT_TYPE;
30+
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_EVENT_CATEGORY;
3131
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_TIMESTAMP;
32-
import static org.elasticsearch.xpack.eql.action.RequestDefaults.IMPLICIT_JOIN_KEY;
32+
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_IMPLICIT_JOIN_KEY;
3333

3434
public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Replaceable, ToXContent {
3535

@@ -39,23 +39,23 @@ public class EqlSearchRequest extends ActionRequest implements IndicesRequest.Re
3939

4040
private QueryBuilder filter = null;
4141
private String timestampField = FIELD_TIMESTAMP;
42-
private String eventTypeField = FIELD_EVENT_TYPE;
43-
private String implicitJoinKeyField = IMPLICIT_JOIN_KEY;
42+
private String eventCategoryField = FIELD_EVENT_CATEGORY;
43+
private String implicitJoinKeyField = FIELD_IMPLICIT_JOIN_KEY;
4444
private int fetchSize = FETCH_SIZE;
4545
private SearchAfterBuilder searchAfterBuilder;
4646
private String query;
4747

4848
static final String KEY_FILTER = "filter";
4949
static final String KEY_TIMESTAMP_FIELD = "timestamp_field";
50-
static final String KEY_EVENT_TYPE_FIELD = "event_type_field";
50+
static final String KEY_EVENT_CATEGORY_FIELD = "event_category_field";
5151
static final String KEY_IMPLICIT_JOIN_KEY_FIELD = "implicit_join_key_field";
5252
static final String KEY_SIZE = "size";
5353
static final String KEY_SEARCH_AFTER = "search_after";
5454
static final String KEY_QUERY = "query";
5555

5656
static final ParseField FILTER = new ParseField(KEY_FILTER);
5757
static final ParseField TIMESTAMP_FIELD = new ParseField(KEY_TIMESTAMP_FIELD);
58-
static final ParseField EVENT_TYPE_FIELD = new ParseField(KEY_EVENT_TYPE_FIELD);
58+
static final ParseField EVENT_CATEGORY_FIELD = new ParseField(KEY_EVENT_CATEGORY_FIELD);
5959
static final ParseField IMPLICIT_JOIN_KEY_FIELD = new ParseField(KEY_IMPLICIT_JOIN_KEY_FIELD);
6060
static final ParseField SIZE = new ParseField(KEY_SIZE);
6161
static final ParseField SEARCH_AFTER = new ParseField(KEY_SEARCH_AFTER);
@@ -73,7 +73,7 @@ public EqlSearchRequest(StreamInput in) throws IOException {
7373
indicesOptions = IndicesOptions.readIndicesOptions(in);
7474
filter = in.readOptionalNamedWriteable(QueryBuilder.class);
7575
timestampField = in.readString();
76-
eventTypeField = in.readString();
76+
eventCategoryField = in.readString();
7777
implicitJoinKeyField = in.readString();
7878
fetchSize = in.readVInt();
7979
searchAfterBuilder = in.readOptionalWriteable(SearchAfterBuilder::new);
@@ -104,11 +104,11 @@ public ActionRequestValidationException validate() {
104104
}
105105

106106
if (timestampField == null || timestampField.isEmpty()) {
107-
validationException = addValidationError("timestamp field is null or empty", validationException);
107+
validationException = addValidationError("@timestamp field is null or empty", validationException);
108108
}
109109

110-
if (eventTypeField == null || eventTypeField.isEmpty()) {
111-
validationException = addValidationError("event type field is null or empty", validationException);
110+
if (eventCategoryField == null || eventCategoryField.isEmpty()) {
111+
validationException = addValidationError("event category field is null or empty", validationException);
112112
}
113113

114114
if (implicitJoinKeyField == null || implicitJoinKeyField.isEmpty()) {
@@ -128,7 +128,7 @@ public XContentBuilder toXContent(XContentBuilder builder, Params params) throws
128128
builder.field(KEY_FILTER, filter);
129129
}
130130
builder.field(KEY_TIMESTAMP_FIELD, timestampField());
131-
builder.field(KEY_EVENT_TYPE_FIELD, eventTypeField());
131+
builder.field(KEY_EVENT_CATEGORY_FIELD, eventCategoryField());
132132
if (implicitJoinKeyField != null) {
133133
builder.field(KEY_IMPLICIT_JOIN_KEY_FIELD, implicitJoinKeyField());
134134
}
@@ -152,7 +152,7 @@ protected static <R extends EqlSearchRequest> ObjectParser<R, Void> objectParser
152152
parser.declareObject(EqlSearchRequest::filter,
153153
(p, c) -> AbstractQueryBuilder.parseInnerQueryBuilder(p), FILTER);
154154
parser.declareString(EqlSearchRequest::timestampField, TIMESTAMP_FIELD);
155-
parser.declareString(EqlSearchRequest::eventTypeField, EVENT_TYPE_FIELD);
155+
parser.declareString(EqlSearchRequest::eventCategoryField, EVENT_CATEGORY_FIELD);
156156
parser.declareString(EqlSearchRequest::implicitJoinKeyField, IMPLICIT_JOIN_KEY_FIELD);
157157
parser.declareInt(EqlSearchRequest::fetchSize, SIZE);
158158
parser.declareField(EqlSearchRequest::setSearchAfter, SearchAfterBuilder::fromXContent, SEARCH_AFTER,
@@ -181,10 +181,10 @@ public EqlSearchRequest timestampField(String timestampField) {
181181
return this;
182182
}
183183

184-
public String eventTypeField() { return this.eventTypeField; }
184+
public String eventCategoryField() { return this.eventCategoryField; }
185185

186-
public EqlSearchRequest eventTypeField(String eventTypeField) {
187-
this.eventTypeField = eventTypeField;
186+
public EqlSearchRequest eventCategoryField(String eventCategoryField) {
187+
this.eventCategoryField = eventCategoryField;
188188
return this;
189189
}
190190

@@ -233,7 +233,7 @@ public void writeTo(StreamOutput out) throws IOException {
233233
indicesOptions.writeIndicesOptions(out);
234234
out.writeOptionalNamedWriteable(filter);
235235
out.writeString(timestampField);
236-
out.writeString(eventTypeField);
236+
out.writeString(eventCategoryField);
237237
out.writeString(implicitJoinKeyField);
238238
out.writeVInt(fetchSize);
239239
out.writeOptionalWriteable(searchAfterBuilder);
@@ -254,7 +254,7 @@ public boolean equals(Object o) {
254254
Objects.equals(indicesOptions, that.indicesOptions) &&
255255
Objects.equals(filter, that.filter) &&
256256
Objects.equals(timestampField, that.timestampField) &&
257-
Objects.equals(eventTypeField, that.eventTypeField) &&
257+
Objects.equals(eventCategoryField, that.eventCategoryField) &&
258258
Objects.equals(implicitJoinKeyField, that.implicitJoinKeyField) &&
259259
Objects.equals(searchAfterBuilder, that.searchAfterBuilder) &&
260260
Objects.equals(query, that.query);
@@ -267,8 +267,7 @@ public int hashCode() {
267267
indicesOptions,
268268
filter,
269269
fetchSize,
270-
timestampField,
271-
eventTypeField,
270+
timestampField, eventCategoryField,
272271
implicitJoinKeyField,
273272
searchAfterBuilder,
274273
query);

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchRequestBuilder.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,8 +30,8 @@ public EqlSearchRequestBuilder timestampField(String timestampField) {
3030
return this;
3131
}
3232

33-
public EqlSearchRequestBuilder eventTypeField(String eventTypeField) {
34-
request.eventTypeField(eventTypeField);
33+
public EqlSearchRequestBuilder eventCategoryField(String eventCategoryField) {
34+
request.eventCategoryField(eventCategoryField);
3535
return this;
3636
}
3737

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/RequestDefaults.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ public final class RequestDefaults {
1010

1111
private RequestDefaults() {}
1212

13-
public static final String FIELD_TIMESTAMP = "timestamp";
14-
public static final String FIELD_EVENT_TYPE = "event_type";
15-
public static final String IMPLICIT_JOIN_KEY = "agent.id";
13+
public static final String FIELD_TIMESTAMP = "@timestamp";
14+
public static final String FIELD_EVENT_CATEGORY = "event.category";
15+
public static final String FIELD_IMPLICIT_JOIN_KEY = "agent.id";
1616

1717
public static int FETCH_SIZE = 50;
1818
}

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/LogicalPlanBuilder.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ public LogicalPlan visitEventQuery(EqlBaseParser.EventQueryContext ctx) {
3838
String eventName = visitIdentifier(ctx.event);
3939
Literal eventValue = new Literal(eventSource, eventName, DataTypes.KEYWORD);
4040

41-
UnresolvedAttribute eventField = new UnresolvedAttribute(eventSource, params.fieldEventType());
41+
UnresolvedAttribute eventField = new UnresolvedAttribute(eventSource, params.fieldEventCategory());
4242
Expression eventMatch = new Equals(eventSource, eventField, eventValue);
4343

4444
condition = new And(source, eventMatch, condition);

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/parser/ParserParams.java

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,23 +9,23 @@
99
import java.util.List;
1010

1111
import static java.util.Collections.emptyList;
12-
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_EVENT_TYPE;
12+
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_EVENT_CATEGORY;
1313
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_TIMESTAMP;
14-
import static org.elasticsearch.xpack.eql.action.RequestDefaults.IMPLICIT_JOIN_KEY;
14+
import static org.elasticsearch.xpack.eql.action.RequestDefaults.FIELD_IMPLICIT_JOIN_KEY;
1515

1616
public class ParserParams {
1717

18-
private String fieldEventType = FIELD_EVENT_TYPE;
18+
private String fieldEventCategory = FIELD_EVENT_CATEGORY;
1919
private String fieldTimestamp = FIELD_TIMESTAMP;
20-
private String implicitJoinKey = IMPLICIT_JOIN_KEY;
20+
private String implicitJoinKey = FIELD_IMPLICIT_JOIN_KEY;
2121
private List<Object> queryParams = emptyList();
2222

23-
public String fieldEventType() {
24-
return fieldEventType;
23+
public String fieldEventCategory() {
24+
return fieldEventCategory;
2525
}
2626

27-
public ParserParams fieldEventType(String fieldEventType) {
28-
this.fieldEventType = fieldEventType;
27+
public ParserParams fieldEventCategory(String fieldEventCategory) {
28+
this.fieldEventCategory = fieldEventCategory;
2929
return this;
3030
}
3131

‎x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/TransportEqlSearchAction.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ public static void operation(PlanExecutor planExecutor, EqlSearchRequest request
6262
String clientId = null;
6363

6464
ParserParams params = new ParserParams()
65-
.fieldEventType(request.eventTypeField())
65+
.fieldEventCategory(request.eventCategoryField())
6666
.fieldTimestamp(request.timestampField())
6767
.implicitJoinKey(request.implicitJoinKeyField());
6868

@@ -85,4 +85,4 @@ static String username(SecurityContext securityContext) {
8585
static String clusterName(ClusterService clusterService) {
8686
return clusterService.getClusterName().value();
8787
}
88-
}
88+
}

0 commit comments

Comments
 (0)