Skip to content

Commit c17a47c

Browse files
AlphayeeeetAlphayeeeet
authored
keycloak: allow ISO8601 datetime format (#14191)
1 parent 75a1f58 commit c17a47c

File tree

5 files changed

+84
-2
lines changed

5 files changed

+84
-2
lines changed

‎packages/keycloak/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.29.0"
3+
changes:
4+
- description: Allow ISO8601 datetime format.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/14191
27
- version: "1.28.0"
38
changes:
49
- description: Set the ECS field `event.outcome` based on the value of `keycloak.login.type`.

‎packages/keycloak/data_stream/log/_dev/test/pipeline/test-log.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,4 @@
2828
at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
2929
2021-10-22 23:05:03,371 DEBUG [org.keycloak.events] (default task-8) operationType=CREATE, realmId=test, clientId=7bcaf1cb-820a-40f1-91dd-75ced03ef03b, userId=ce637d23-b89c-4fca-9088-1aea1d053e19, ipAddress=10.2.2.156, resourceType=GROUP, resourcePath=groups/a57cd49f-fdfd-4d25-9fd2-2a46de44a9e6/children
3030
2024-07-17 12:05:32,104 INFO [org.keycloak.events] (main-thread-1) type=\"LOGOUT\", realmId=\"12345678-9abc-def0-1234-56789abcdef0\", clientId=\"user-console\", userId=\"abcdef12-3456-7890-abcd-ef1234567890\", sessionId=\"abcd1234-5678-90ab-cdef-1234567890ab\", ipAddress=\"192.168.1.1\", auth_method=\"oauth2\", auth_type=\"token\", response_type=\"token\", redirect_uri=\"https://example.com/realms/demo/account/\", consent=\"consent_required\", code_id=\"abcd1234-5678-90ab-cdef-1234567890ab\", response_mode=\"fragment\", username=\"dummyuser\", authSessionParentId=\"abcd1234-5678-90ab-cdef-1234567890ab\", authSessionTabId=\"zXY987wvuTsr\"
31+
2024-07-17T12:05:32,104 INFO [org.keycloak.events] (main-thread-1) type=\"LOGOUT\", realmId=\"12345678-9abc-def0-1234-56789abcdef0\", clientId=\"user-console\", userId=\"abcdef12-3456-7890-abcd-ef1234567890\", sessionId=\"abcd1234-5678-90ab-cdef-1234567890ab\", ipAddress=\"192.168.1.1\", auth_method=\"oauth2\", auth_type=\"token\", response_type=\"token\", redirect_uri=\"https://example.com/realms/demo/account/\", consent=\"consent_required\", code_id=\"abcd1234-5678-90ab-cdef-1234567890ab\", response_mode=\"fragment\", username=\"dummyuser\", authSessionParentId=\"abcd1234-5678-90ab-cdef-1234567890ab\", authSessionTabId=\"zXY987wvuTsr\"

‎packages/keycloak/data_stream/log/_dev/test/pipeline/test-log.log-expected.json‎

Lines changed: 75 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -519,7 +519,6 @@
519519
],
520520
"url": {
521521
"domain": "www.example.com",
522-
"extension": "sso/SAML2/POST",
523522
"original": "https://www.example.com/Shibboleth.sso/SAML2/POST",
524523
"path": "/Shibboleth.sso/SAML2/POST",
525524
"scheme": "https"
@@ -1237,6 +1236,81 @@
12371236
"id": "abcdef12-3456-7890-abcd-ef1234567890",
12381237
"name": "dummyuser"
12391238
}
1239+
},
1240+
{
1241+
"@timestamp": "2024-07-17T12:05:32.104-05:00",
1242+
"ecs": {
1243+
"version": "8.11.0"
1244+
},
1245+
"event": {
1246+
"action": "LOGOUT",
1247+
"category": [
1248+
"authentication"
1249+
],
1250+
"kind": "event",
1251+
"original": "2024-07-17T12:05:32,104 INFO [org.keycloak.events] (main-thread-1) type=\\\"LOGOUT\\\", realmId=\\\"12345678-9abc-def0-1234-56789abcdef0\\\", clientId=\\\"user-console\\\", userId=\\\"abcdef12-3456-7890-abcd-ef1234567890\\\", sessionId=\\\"abcd1234-5678-90ab-cdef-1234567890ab\\\", ipAddress=\\\"192.168.1.1\\\", auth_method=\\\"oauth2\\\", auth_type=\\\"token\\\", response_type=\\\"token\\\", redirect_uri=\\\"https://example.com/realms/demo/account/\\\", consent=\\\"consent_required\\\", code_id=\\\"abcd1234-5678-90ab-cdef-1234567890ab\\\", response_mode=\\\"fragment\\\", username=\\\"dummyuser\\\", authSessionParentId=\\\"abcd1234-5678-90ab-cdef-1234567890ab\\\", authSessionTabId=\\\"zXY987wvuTsr\\\"",
1252+
"outcome": "unknown",
1253+
"timezone": "America/Chicago",
1254+
"type": [
1255+
"info",
1256+
"end"
1257+
]
1258+
},
1259+
"keycloak": {
1260+
"client": {
1261+
"id": "user-console"
1262+
},
1263+
"event_type": "login",
1264+
"login": {
1265+
"auth_method": "oauth2",
1266+
"auth_session_parent_id": "abcd1234-5678-90ab-cdef-1234567890ab",
1267+
"auth_session_tab_id": "zXY987wvuTsr",
1268+
"auth_type": "token",
1269+
"code_id": "abcd1234-5678-90ab-cdef-1234567890ab",
1270+
"redirect_uri": "https://example.com/realms/demo/account/",
1271+
"type": "LOGOUT"
1272+
},
1273+
"realm": {
1274+
"id": "12345678-9abc-def0-1234-56789abcdef0"
1275+
}
1276+
},
1277+
"log": {
1278+
"level": "INFO",
1279+
"logger": "org.keycloak.events"
1280+
},
1281+
"process": {
1282+
"thread": {
1283+
"name": "main-thread-1"
1284+
}
1285+
},
1286+
"related": {
1287+
"hosts": [
1288+
"example.com"
1289+
],
1290+
"ip": [
1291+
"192.168.1.1"
1292+
],
1293+
"user": [
1294+
"abcdef12-3456-7890-abcd-ef1234567890"
1295+
]
1296+
},
1297+
"source": {
1298+
"address": "192.168.1.1",
1299+
"ip": "192.168.1.1"
1300+
},
1301+
"tags": [
1302+
"preserve_original_event"
1303+
],
1304+
"url": {
1305+
"domain": "example.com",
1306+
"original": "https://example.com/realms/demo/account/",
1307+
"path": "/realms/demo/account/",
1308+
"scheme": "https"
1309+
},
1310+
"user": {
1311+
"id": "abcdef12-3456-7890-abcd-ef1234567890",
1312+
"name": "dummyuser"
1313+
}
12401314
}
12411315
]
12421316
}

‎packages/keycloak/data_stream/log/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,13 +26,15 @@ processors:
2626
timezone: "{{{ event.timezone }}}"
2727
formats:
2828
- yyyy-MM-dd HH:mm:ss,SSS
29+
- ISO8601
2930
if: ctx.event?.timezone != null
3031
tag: date_timestamp_timezone
3132
- date:
3233
field: _tmp.timestamp
3334
target_field: '@timestamp'
3435
formats:
3536
- yyyy-MM-dd HH:mm:ss,SSS
37+
- ISO8601
3638
if: ctx.event?.timezone == null
3739
tag: date_timestamp_no_timezone
3840
- pipeline:

‎packages/keycloak/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: keycloak
22
title: Keycloak
3-
version: "1.28.0"
3+
version: "1.29.0"
44
description: Collect logs from Keycloak with Elastic Agent.
55
type: integration
66
format_version: "3.0.3"

0 commit comments

Comments
 (0)