Skip to content

Commit 80b9687

Browse files
moxarth-rathodmoxarth-rathod
authored
[Google Workspace] Fix pipeline for login data stream (#15743)
google_workspace: convert google_workspace.login.timestamp field to long in login data stream
1 parent 722e59e commit 80b9687

File tree

7 files changed

+114
-1
lines changed

7 files changed

+114
-1
lines changed

‎packages/google_workspace/changelog.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,13 @@
11
# newer versions go on top
2+
- version: "2.47.0"
3+
changes:
4+
- description: >-
5+
Add support for `resource_ids`, `network_info.region_code`, `network_info.subdivision_code`, and `network_info.ip_asn` fields for login data stream.
6+
type: enhancement
7+
link: https://github.com/elastic/integrations/pull/15743
8+
- description: Convert `login.timestamp` to long for login data stream.
9+
type: bugfix
10+
link: https://github.com/elastic/integrations/pull/15743
211
- version: "2.46.0"
312
changes:
413
- description: >-

‎packages/google_workspace/data_stream/login/_dev/test/pipeline/test-login.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,4 @@
1515
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"login","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"login","name":"login_success","parameters":[{"name":"login_challenge_method","value":"password"},{"name":"is_suspicious","boolValue":true},{"name":"login_type","value":"google_password"}]}}
1616
{"kind":"admin#reports#activity","id":{"time":"2020-10-02T15:00:00Z","uniqueQualifier":1,"applicationName":"login","customerId":"1"},"actor":{"callerType":"USER","email":"foo@bar.com","profileId":1},"ownerDomain":"elastic.com","ipAddress":"67.43.156.13","events":{"type":"login","name":"risky_sensitive_action_allowed","parameters":[{"name":"login_challenge_method","value":"password"},{"name":"is_suspicious","boolValue":true},{"name":"login_type","value":"google_password"},{"name":"login_challenge_status","value":"Challenge Passed."},{"name":"sensitive_action_name","value":"Allowing access to data"}]}}
1717
{"actor":{"email":"tl.zeous.daclitan@company.com","profileId":"111111111"},"etag":"Q2W123123123123","events":{"name":"login_verification","parameters":[{"name":"login_type","value":"google_password"},{"multiValue":["security_key"],"name":"login_challenge_method"},{"name":"login_challenge_status","value":"passed"},{"boolValue":true,"name":"is_second_factor"}],"type":"login"},"id":{"applicationName":"login","customerId":"123","time":"2025-02-27T05:59:58.481Z","uniqueQualifier":"123"},"ipAddress":"81.2.69.144","kind":"admin#reports#activity"}
18+
{"actor":{"callerType":"KEY","key":"Google"},"etag":"\"Fn96D9A6wOUVq518\"","events":{"name":"suspicious_login","parameters":[{"name":"affected_email_address","value":"foo@elastic.co"},{"intValue":"1759325583000000","name":"login_timestamp"}],"resourceIds":["1084964178399"],"type":"account_warning"},"id":{"applicationName":"login","customerId":"2","time":"2025-10-01T13:33:03.000Z","uniqueQualifier":"-780557281442037232"},"ipAddress":"1.128.0.0","kind":"admin#reports#activity","networkInfo":{"regionCode":"FR","subdivisionCode":"FR-NAQ"},"resourceDetails":[{"id":"0000000000000","type":"USER"}]}

‎packages/google_workspace/data_stream/login/_dev/test/pipeline/test-login.log-expected.json‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1349,6 +1349,73 @@
13491349
"id": "111111111",
13501350
"name": "tl.zeous.daclitan"
13511351
}
1352+
},
1353+
{
1354+
"@timestamp": "2025-10-01T13:33:03.000Z",
1355+
"ecs": {
1356+
"version": "8.16.0"
1357+
},
1358+
"event": {
1359+
"action": "suspicious_login",
1360+
"category": [
1361+
"authentication"
1362+
],
1363+
"id": "-780557281442037232",
1364+
"kind": "event",
1365+
"original": "{\"actor\":{\"callerType\":\"KEY\",\"key\":\"Google\"},\"etag\":\"\\\"Fn96D9A6wOUVq518\\\"\",\"events\":{\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"intValue\":\"1759325583000000\",\"name\":\"login_timestamp\"}],\"resourceIds\":[\"1084964178399\"],\"type\":\"account_warning\"},\"id\":{\"applicationName\":\"login\",\"customerId\":\"2\",\"time\":\"2025-10-01T13:33:03.000Z\",\"uniqueQualifier\":\"-780557281442037232\"},\"ipAddress\":\"1.128.0.0\",\"kind\":\"admin#reports#activity\",\"networkInfo\":{\"regionCode\":\"FR\",\"subdivisionCode\":\"FR-NAQ\"},\"resourceDetails\":[{\"id\":\"0000000000000\",\"type\":\"USER\"}]}",
1366+
"provider": "login",
1367+
"start": "2025-10-01T13:33:03.000Z",
1368+
"type": [
1369+
"info"
1370+
]
1371+
},
1372+
"google_workspace": {
1373+
"actor": {
1374+
"key": "Google",
1375+
"type": "KEY"
1376+
},
1377+
"event": {
1378+
"type": "account_warning"
1379+
},
1380+
"kind": "admin#reports#activity",
1381+
"login": {
1382+
"affected_email_address": "foo@elastic.co",
1383+
"network_info": {
1384+
"region_code": "FR",
1385+
"subdivision_code": "FR-NAQ"
1386+
},
1387+
"timestamp": 1759325583000000
1388+
}
1389+
},
1390+
"organization": {
1391+
"id": "2"
1392+
},
1393+
"related": {
1394+
"ip": [
1395+
"1.128.0.0"
1396+
],
1397+
"user": [
1398+
"foo"
1399+
]
1400+
},
1401+
"source": {
1402+
"as": {
1403+
"number": 1221,
1404+
"organization": {
1405+
"name": "Telstra Pty Ltd"
1406+
}
1407+
},
1408+
"ip": "1.128.0.0"
1409+
},
1410+
"tags": [
1411+
"preserve_original_event"
1412+
],
1413+
"user": {
1414+
"target": {
1415+
"domain": "elastic.co",
1416+
"name": "foo"
1417+
}
1418+
}
13521419
}
13531420
]
13541421
}

‎packages/google_workspace/data_stream/login/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,27 @@ processors:
215215
ctx.google_workspace.login[ctx["json"]["events"]["parameters"][i]["name"]] = ctx["json"]["events"]["parameters"][i]["boolValue"];
216216
}
217217
}
218+
- rename:
219+
field: json.networkInfo.ipAsn
220+
target_field: google_workspace.login.network_info.ip_asn
221+
ignore_missing: true
222+
- rename:
223+
field: json.networkInfo.regionCode
224+
target_field: google_workspace.login.network_info.region_code
225+
ignore_missing: true
226+
- rename:
227+
field: json.networkInfo.subdivisionCode
228+
target_field: google_workspace.login.network_info.subdivision_code
229+
ignore_missing: true
230+
- rename:
231+
field: json.resourceIds
232+
target_field: google_workspace.login.resource_ids
233+
ignore_missing: true
234+
- convert:
235+
field: google_workspace.login.timestamp
236+
target_field: google_workspace.login.timestamp
237+
type: long
238+
ignore_missing: true
218239
- script:
219240
lang: painless
220241
if: ctx?.google_workspace?.login?.timestamp != null

‎packages/google_workspace/data_stream/login/fields/fields.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,17 @@
1515
type: keyword
1616
description: |
1717
Login challenge status. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login.
18+
- name: network_info
19+
type: group
20+
fields:
21+
- name: ip_asn
22+
type: keyword
23+
- name: region_code
24+
type: keyword
25+
- name: subdivision_code
26+
type: keyword
27+
- name: resource_ids
28+
type: keyword
1829
- name: timestamp
1930
type: long
2031
description: |

‎packages/google_workspace/docs/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -627,6 +627,10 @@ An example event for `login` looks as following:
627627
| google_workspace.login.failure_type | Login failure type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. | keyword |
628628
| google_workspace.login.is_second_factor | | boolean |
629629
| google_workspace.login.is_suspicious | | boolean |
630+
| google_workspace.login.network_info.ip_asn | | keyword |
631+
| google_workspace.login.network_info.region_code | | keyword |
632+
| google_workspace.login.network_info.subdivision_code | | keyword |
633+
| google_workspace.login.resource_ids | | keyword |
630634
| google_workspace.login.sensitive_action_name | | keyword |
631635
| google_workspace.login.timestamp | UNIX timestmap of login in microseconds. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. | long |
632636
| google_workspace.login.type | Login credentials type. For a list of possible values refer to https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login. | keyword |

‎packages/google_workspace/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: google_workspace
22
title: Google Workspace
3-
version: "2.46.0"
3+
version: "2.47.0"
44
source:
55
license: Elastic-2.0
66
description: Collect logs from Google Workspace with Elastic Agent.

0 commit comments

Comments
 (0)