Merge branch 'main' into feature/strip_linux_oquerybeat

elastic · Apr 17, 2024 · cbf2753 · cbf2753
2 parents 4f8c44e + eb122ef
commit cbf2753
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 5 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -132,6 +132,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix filestream's registry GC: registry entries are now removed from the in-memory and disk store when they're older than the set TTL {issue}36761[36761] {pull}38488[38488]
 - [threatintel] MISP splitting fix for empty responses {issue}38739[38739] {pull}38917[38917]
 - Prevent GCP Pub/Sub input blockage by increasing default value of `max_outstanding_messages` {issue}35029[35029] {pull}38985[38985]
+- entity-analytics input: Improve structured logging. {pull}38990[38990]
 - Fix config validation for CEL and HTTPJSON inputs when using password grant authentication and `client.id` or `client.secret` are not present. {pull}38962[38962]
 - Updated Websocket input title to align with existing inputs {pull}39006[39006]
 

diff --git a/x-pack/filebeat/docs/inputs/input-entity-analytics.asciidoc b/x-pack/filebeat/docs/inputs/input-entity-analytics.asciidoc
@@ -498,13 +498,13 @@ This is a list of optional query parameters. The default is `["accountEnabled",
 [float]
 ===== `select.groups`
 
-Override the default https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http#optional-query-parameters[group query selections].
+Override the default https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0&tabs=http#optional-query-parameters[group query selections].
 This is a list of optional query parameters. The default is `["displayName", "members"]`.
 
 [float]
 ===== `select.devices`
 
-Override the default https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0&tabs=http#optional-query-parameters[device query selections].
+Override the default https://learn.microsoft.com/en-us/graph/api/device-get?view=graph-rest-1.0&tabs=http#optional-query-parameters[device query selections].
 This is a list of optional query parameters. The default is `["accountEnabled", "deviceId",
 "displayName", "operatingSystem", "operatingSystemVersion", "physicalIds", "extensionAttributes",
 "alternativeSecurityIds"]`.

diff --git a/x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go b/x-pack/filebeat/input/entityanalytics/provider/azuread/fetcher/graph/graph.go
@@ -206,7 +206,7 @@ func (f *graph) Users(ctx context.Context, deltaLink string) ([]*fetcher.User, s
 		for _, v := range response.Users {
 			user, err := newUserFromAPI(v)
 			if err != nil {
-				f.logger.Errorf("Unable to parse user from API: %w", err)
+				f.logger.Errorw("Unable to parse user from API", "error", err)
 				continue
 			}
 			f.logger.Debugf("Got user %q from API", user.ID)
@@ -258,7 +258,7 @@ func (f *graph) Devices(ctx context.Context, deltaLink string) ([]*fetcher.Devic
 		for _, v := range response.Devices {
 			device, err := newDeviceFromAPI(v)
 			if err != nil {
-				f.logger.Errorf("Unable to parse device from API: %w", err)
+				f.logger.Errorw("Unable to parse device from API", "error", err)
 				continue
 			}
 			f.logger.Debugf("Got device %q from API", device.ID)
@@ -290,7 +290,7 @@ func (f *graph) addRegistered(ctx context.Context, device *fetcher.Device, typ s
 	switch {
 	case err == nil, errors.Is(err, nextLinkLoopError{"users"}), errors.Is(err, missingLinkError{"users"}):
 	default:
-		f.logger.Errorf("Failed to obtain some registered user data: %w", err)
+		f.logger.Errorw("Failed to obtain some registered user data", "error", err)
 	}
 	for _, u := range users {
 		set.Add(u.ID)