Fix Google Workspace cursor date parsing (elastic#24668)

Richardjgq · Mar 22, 2021 · 7964c23 · 7964c23
1 parent a7290fd
commit 7964c23
Show file tree

Hide file tree

Showing 7 changed files with 13 additions and 12 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -402,6 +402,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix netflow module ignoring detect_sequence_reset flag. {issue}24268[24268] {pull}24270[24270]
 - Fix default `scope` in `add_nomad_metadata`. {issue}24559[24559]
 - Fix Cisco ASA parser for message 722051. {pull}24410[24410]
+- Fix `google_workspace` pagination. {pull}[]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/module/google_workspace/admin/config/config.yml b/x-pack/filebeat/module/google_workspace/admin/config/config.yml
@@ -15,7 +15,7 @@ request.transforms:
   - set:
       target: url.params.startTime
       value: "[[.cursor.last_execution_datetime]]"
-      default: '[[parseDate now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}"))]]'
 response.split:
   target: body.items
   split:
@@ -27,7 +27,7 @@ response.pagination:
       value: "[[.last_response.body.nextPageToken]]"
 cursor:
   last_execution_datetime:
-    value: "[[now]]"
+    value: "[[formatDate now]]"
 
 {{ else if eq .input "file" }}
 type: log

diff --git a/x-pack/filebeat/module/google_workspace/drive/config/config.yml b/x-pack/filebeat/module/google_workspace/drive/config/config.yml
@@ -15,7 +15,7 @@ request.transforms:
   - set:
       target: url.params.startTime
       value: "[[.cursor.last_execution_datetime]]"
-      default: '[[parseDate now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}"))]]'
 response.split:
   target: body.items
   split:
@@ -27,7 +27,7 @@ response.pagination:
       value: "[[.last_response.body.nextPageToken]]"
 cursor:
   last_execution_datetime:
-    value: "[[now]]"
+    value: "[[formatDate now]]"
 
 {{ else if eq .input "file" }}
 type: log

diff --git a/x-pack/filebeat/module/google_workspace/groups/config/config.yml b/x-pack/filebeat/module/google_workspace/groups/config/config.yml
@@ -15,7 +15,7 @@ request.transforms:
   - set:
       target: url.params.startTime
       value: "[[.cursor.last_execution_datetime]]"
-      default: '[[parseDate now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}"))]]'
 response.split:
   target: body.items
   split:
@@ -27,7 +27,7 @@ response.pagination:
       value: "[[.last_response.body.nextPageToken]]"
 cursor:
   last_execution_datetime:
-    value: "[[now]]"
+    value: "[[formatDate now]]"
 
 {{ else if eq .input "file" }}
 type: log

diff --git a/x-pack/filebeat/module/google_workspace/login/config/config.yml b/x-pack/filebeat/module/google_workspace/login/config/config.yml
@@ -15,7 +15,7 @@ request.transforms:
   - set:
       target: url.params.startTime
       value: "[[.cursor.last_execution_datetime]]"
-      default: '[[parseDate now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}"))]]'
 response.split:
   target: body.items
   split:
@@ -27,7 +27,7 @@ response.pagination:
       value: "[[.last_response.body.nextPageToken]]"
 cursor:
   last_execution_datetime:
-    value: "[[now]]"
+    value: "[[formatDate now]]"
 
 {{ else if eq .input "file" }}
 type: log

diff --git a/x-pack/filebeat/module/google_workspace/saml/config/config.yml b/x-pack/filebeat/module/google_workspace/saml/config/config.yml
@@ -15,7 +15,7 @@ request.transforms:
   - set:
       target: url.params.startTime
       value: "[[.cursor.last_execution_datetime]]"
-      default: '[[parseDate now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}"))]]'
 response.split:
   target: body.items
   split:
@@ -27,7 +27,7 @@ response.pagination:
       value: "[[.last_response.body.nextPageToken]]"
 cursor:
   last_execution_datetime:
-    value: "[[now]]"
+    value: "[[formatDate now]]"
 
 {{ else if eq .input "file" }}
 type: log

diff --git a/x-pack/filebeat/module/google_workspace/user_accounts/config/config.yml b/x-pack/filebeat/module/google_workspace/user_accounts/config/config.yml
@@ -15,7 +15,7 @@ request.transforms:
   - set:
       target: url.params.startTime
       value: "[[.cursor.last_execution_datetime]]"
-      default: '[[parseDate now (parseDuration "-{{.initial_interval}}")]]'
+      default: '[[formatDate (now (parseDuration "-{{.initial_interval}}"))]]'
 response.split:
   target: body.items
   split:
@@ -27,7 +27,7 @@ response.pagination:
       value: "[[.last_response.body.nextPageToken]]"
 cursor:
   last_execution_datetime:
-    value: "[[now]]"
+    value: "[[formatDate now]]"
 
 {{ else if eq .input "file" }}
 type: log