[jamf_pro] Add event.module definition for the events data stream #14017
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,29 +1,30 @@ | ||
| { | ||
| "@timestamp": "2025-05-27T14:10:23.470Z", | ||
| "agent": { | ||
| "ephemeral_id": "05a484da-a7b8-4044-95c7-faae1b7cffb6", | ||
| "id": "15f5630f-b7fd-4c63-b4af-730817ddff2d", | ||
| "name": "elastic-agent-32235", | ||
| "type": "filebeat", | ||
| "version": "8.13.4" | ||
| }, | ||
| "data_stream": { | ||
| "dataset": "jamf_pro.events", | ||
| "namespace": "11652", | ||
| "type": "logs" | ||
| }, | ||
| "ecs": { | ||
| "version": "8.11.0" | ||
| }, | ||
| "elastic_agent": { | ||
| "id": "15f5630f-b7fd-4c63-b4af-730817ddff2d", | ||
| "snapshot": false, | ||
| "version": "8.13.4" | ||
| }, | ||
| "event": { | ||
| "action": "ComputerAdded", | ||
| "agent_id_status": "verified", | ||
| "dataset": "jamf_pro.events", | ||
| "ingested": "2025-05-27T14:10:24Z", | ||
| "kind": "event", | ||
| "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}" | ||
| }, | ||
|
|
@@ -102,4 +103,4 @@ | |
| "email": "kghrqq@email.com", | ||
| "name": "John Doe" | ||
| } | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -16,6 +16,8 @@ | |
| - name: event.dataset | ||
| type: constant_keyword | ||
| value: jamf_pro.inventory | ||
| external: ecs | ||
| - name: event.module | ||
| type: constant_keyword | ||
| value: jamf_pro | ||
| external: ecs | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,29 +1,29 @@ | ||
| { | ||
| "@timestamp": "2025-05-27T14:11:07.015Z", | ||
| "agent": { | ||
| "ephemeral_id": "dab976fe-f898-4ec6-92c6-84b21b4c379a", | ||
| "id": "16c644f3-4469-4b8d-8ed7-20ccd22185f5", | ||
| "name": "elastic-agent-58306", | ||
| "type": "filebeat", | ||
| "version": "8.13.4" | ||
| }, | ||
| "data_stream": { | ||
| "dataset": "jamf_pro.inventory", | ||
| "namespace": "42032", | ||
| "type": "logs" | ||
| }, | ||
| "ecs": { | ||
| "version": "8.11.0" | ||
| }, | ||
| "elastic_agent": { | ||
| "id": "16c644f3-4469-4b8d-8ed7-20ccd22185f5", | ||
| "snapshot": false, | ||
| "version": "8.13.4" | ||
| }, | ||
| "event": { | ||
| "agent_id_status": "verified", | ||
| "dataset": "jamf_pro.inventory", | ||
| "ingested": "2025-05-27T14:11:10Z", | ||
| "kind": "asset" | ||
| }, | ||
| "host": { | ||
|
|
@@ -59,7 +59,7 @@ | |
| "remote_management": { | ||
| "managed": true | ||
| }, | ||
| "report_date": "2024-06-19T15:54:37.68Z", | ||
| "site": { | ||
| "id": "-1", | ||
| "name": "None" | ||
|
|
@@ -68,7 +68,7 @@ | |
| "user_approved_mdm": false | ||
| }, | ||
| "id": "3", | ||
| "udid": "5982CE36-4526-580B-B4B9-ECC6782535BB" | ||
| } | ||
| }, | ||
| "os": { | ||
|
|
@@ -77,12 +77,9 @@ | |
| "related": { | ||
| "ip": [ | ||
| "10.122.26.87" | ||
| ] | ||
| }, | ||
| "tags": [ | ||
| "forwarded" | ||
| ] | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -104,31 +104,31 @@ An example event for `inventory` looks as following: | |
|
|
||
| ```json | ||
| { | ||
| "@timestamp": "2025-05-27T14:11:07.015Z", | ||
| "agent": { | ||
| "ephemeral_id": "dab976fe-f898-4ec6-92c6-84b21b4c379a", | ||
| "id": "16c644f3-4469-4b8d-8ed7-20ccd22185f5", | ||
| "name": "elastic-agent-58306", | ||
| "type": "filebeat", | ||
| "version": "8.13.4" | ||
| }, | ||
| "data_stream": { | ||
| "dataset": "jamf_pro.inventory", | ||
| "namespace": "42032", | ||
| "type": "logs" | ||
| }, | ||
| "ecs": { | ||
| "version": "8.11.0" | ||
| }, | ||
| "elastic_agent": { | ||
| "id": "16c644f3-4469-4b8d-8ed7-20ccd22185f5", | ||
| "snapshot": false, | ||
| "version": "8.13.4" | ||
| }, | ||
| "event": { | ||
| "agent_id_status": "verified", | ||
| "dataset": "jamf_pro.inventory", | ||
| "ingested": "2025-05-27T14:11:10Z", | ||
| "kind": "asset" | ||
| }, | ||
| "host": { | ||
|
|
@@ -164,7 +164,7 @@ An example event for `inventory` looks as following: | |
| "remote_management": { | ||
| "managed": true | ||
| }, | ||
| "report_date": "2024-06-19T15:54:37.68Z", | ||
| "site": { | ||
| "id": "-1", | ||
| "name": "None" | ||
|
|
@@ -173,7 +173,7 @@ An example event for `inventory` looks as following: | |
| "user_approved_mdm": false | ||
| }, | ||
| "id": "3", | ||
| "udid": "5982CE36-4526-580B-B4B9-ECC6782535BB" | ||
| } | ||
| }, | ||
| "os": { | ||
|
|
@@ -182,9 +182,6 @@ An example event for `inventory` looks as following: | |
| "related": { | ||
| "ip": [ | ||
| "10.122.26.87" | ||
| ] | ||
| }, | ||
| "tags": [ | ||
|
|
@@ -203,8 +200,8 @@ The following non-ECS fields are used in inventory documents: | |
| | data_stream.dataset | Data stream dataset. | constant_keyword | | ||
| | data_stream.namespace | Data stream namespace. | constant_keyword | | ||
| | data_stream.type | Data stream type. | constant_keyword | | ||
| | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | ||
| | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | ||
| | input.type | Input type | keyword | | ||
| | jamf_pro.inventory.applications.bundle_id | | keyword | | ||
| | jamf_pro.inventory.applications.external_version_id | | keyword | | ||
|
|
@@ -387,31 +384,32 @@ An example event for `events` looks as following: | |
|
|
||
| ```json | ||
| { | ||
| "@timestamp": "2025-05-27T14:10:23.470Z", | ||
| "agent": { | ||
| "ephemeral_id": "05a484da-a7b8-4044-95c7-faae1b7cffb6", | ||
| "id": "15f5630f-b7fd-4c63-b4af-730817ddff2d", | ||
| "name": "elastic-agent-32235", | ||
| "type": "filebeat", | ||
| "version": "8.13.4" | ||
| }, | ||
| "data_stream": { | ||
| "dataset": "jamf_pro.events", | ||
| "namespace": "11652", | ||
| "type": "logs" | ||
| }, | ||
| "ecs": { | ||
| "version": "8.11.0" | ||
| }, | ||
| "elastic_agent": { | ||
| "id": "15f5630f-b7fd-4c63-b4af-730817ddff2d", | ||
| "snapshot": false, | ||
| "version": "8.13.4" | ||
| }, | ||
| "event": { | ||
| "action": "ComputerAdded", | ||
| "agent_id_status": "verified", | ||
| "dataset": "jamf_pro.events", | ||
| "ingested": "2025-05-27T14:10:24Z", | ||
| "kind": "event", | ||
| "original": "{\"event\":{\"alternateMacAddress\":\"be:aa:e5:54:94:db\",\"building\":\"1S8NPV\",\"department\":\"XDO4C5\",\"deviceName\":\"VPNYC\",\"emailAddress\":\"kghrqq@email.com\",\"ipAddress\":\"89.160.20.156\",\"jssID\":\"1500747557\",\"macAddress\":\"be:aa:e5:54:94:db\",\"managementId\":\"6319330669\",\"model\":\"LJ68RT\",\"osBuild\":\"26.6913\",\"osVersion\":\"92.5786\",\"phone\":\"2183546\",\"position\":\"B64JIO\",\"realName\":\"CPK79\",\"reportedIpAddress\":\"89.160.20.156\",\"room\":\"HQC6S9\",\"serialNumber\":\"7967177\",\"udid\":\"7265694772\",\"userDirectory_id\":\"0389771137\",\"username\":\"John Doe\"},\"webhook\":{\"eventTimestamp\":1725443872001,\"id\":\"8131946016\",\"name\":\"PU17M\",\"webhookEvent\":\"ComputerAdded\"}}" | ||
| }, | ||
|
|
@@ -503,7 +501,8 @@ The following non-ECS fields are used in real-time event documents: | |
| | data_stream.dataset | Data stream dataset. | constant_keyword | | ||
| | data_stream.namespace | Data stream namespace. | constant_keyword | | ||
| | data_stream.type | Data stream type. | constant_keyword | | ||
| | event.dataset | Name of the dataset. If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from. It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | constant_keyword | | ||
| | event.module | Name of the module this data is coming from. If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | constant_keyword | | ||
| | input.type | | keyword | | ||
| | jamf_pro.events.event.alternate_mac_address | | keyword | | ||
| | jamf_pro.events.event.asset_tag | | keyword | | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,7 @@ | ||
| format_version: 3.1.5 | ||
| name: jamf_pro | ||
| title: "Jamf Pro" | ||
| version: "0.5.3" | ||
| source: | ||
| license: "Elastic-2.0" | ||
| description: "Collect logs and inventory data from Jamf Pro with Elastic Agent" | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done for this and
event.datasetandevent.modulein both data streams.