From 6b7ceb9994d8d8c8dc9de94f750b024da8369135 Mon Sep 17 00:00:00 2001 From: Nicholas Berlin Date: Fri, 24 Jul 2026 13:37:44 -0400 Subject: [PATCH] [system][auth] Remove deprecated user.name/user.id duplication for IAM events Contract phase of the expand-and-contract migration started in 2.22.0 (elastic/integrations#20339): the auth data stream no longer writes the affected account to user.name/user.id for useradd account creation, usermod group membership, userdel deletion, and PAM password change events. The affected account remains in user.target.name (and user.target.id for useradd); user.name on these events is reserved for the acting user, matching ECS semantics. On journald input, useradd events now keep the actor UID from journald metadata in user.id instead of having it overwritten by the created account's UID. Mechanically this deletes the five *_compat processors that 2.22.0 introduced for backward compatibility and regenerates the pipeline test expectations, whose diff is exactly the removal of the duplicated fields. Ships as 3.0.0 with a breaking-change changelog entry so Kibana requires users to acknowledge the change before upgrading. The bundled New users and groups dashboard already reads user.target.* as of 2.23.0. --- packages/system/changelog.yml | 6 +++ ...ian11-preserve-original.json-expected.json | 7 +-- .../test-auth-debian11.json-expected.json | 7 +-- .../test-auth-rhel79.log-expected.json | 2 - .../test-auth-ubuntu1204.log-expected.json | 5 -- .../test/pipeline/test-auth.log-expected.json | 2 - ...st-pam-chauthtok-iso8601.log-expected.json | 1 - .../test-pam-extraction.log-expected.json | 1 - .../pipeline/test-userdel.log-expected.json | 1 - .../test-usermod-group.log-expected.json | 2 - .../elasticsearch/ingest_pipeline/message.yml | 47 ------------------- packages/system/manifest.yml | 2 +- 12 files changed, 9 insertions(+), 74 deletions(-) diff --git a/packages/system/changelog.yml b/packages/system/changelog.yml index 500ce8c3c66..bd23ce0e724 100644 --- a/packages/system/changelog.yml +++ b/packages/system/changelog.yml @@ -1,4 +1,10 @@ # later versions go on top +- version: "3.0.0" + changes: + - description: >- + The auth data stream no longer writes the affected account to `user.name`/`user.id` for useradd account creation, usermod group membership, userdel deletion, and PAM password change events. Since system 2.22.0 the affected account is available in `user.target.name` (and `user.target.id` for useradd), and `user.name` on these events is reserved for the acting user, matching ECS semantics. This completes the deprecation announced in 2.22.0. Before upgrading, update detection rules, saved searches, dashboards, and other content that reads the affected account from `user.name`/`user.id` on these events to use `user.target.*` instead — content still keyed on `user.name` will stop matching these events after this upgrade. The bundled New users and groups dashboard already uses `user.target.*` as of 2.23.0. + type: breaking-change + link: https://github.com/elastic/integrations/issues/20105 - version: "2.22.0" changes: - description: >- diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json index be17f07db19..b5ed99d7e76 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11-preserve-original.json-expected.json @@ -89,8 +89,7 @@ }, "id": "0" }, - "id": "107", - "name": "systemd-journal-remote", + "id": "1000", "target": { "id": "107", "name": "systemd-journal-remote" @@ -982,7 +981,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1061,7 +1059,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1140,7 +1137,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1360,7 +1356,6 @@ "id": "0" }, "id": "1000", - "name": "fred", "target": { "name": "fred" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json index 9f82922f64a..0c2677e8f9e 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-debian11.json-expected.json @@ -86,8 +86,7 @@ }, "id": "0" }, - "id": "107", - "name": "systemd-journal-remote", + "id": "1000", "target": { "id": "107", "name": "systemd-journal-remote" @@ -949,7 +948,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1025,7 +1023,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1104,7 +1101,6 @@ "id": "0" }, "id": "1000", - "name": "foo", "target": { "name": "foo" } @@ -1315,7 +1311,6 @@ "id": "0" }, "id": "1000", - "name": "fred", "target": { "name": "fred" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json index a4331f7c3b8..c8221fa984c 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-rhel79.log-expected.json @@ -83,7 +83,6 @@ "auth": {} }, "user": { - "name": "jce", "target": { "name": "jce" } @@ -129,7 +128,6 @@ "auth": {} }, "user": { - "name": "acris", "target": { "name": "acris" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json index fe741c65869..3e90606eee0 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth-ubuntu1204.log-expected.json @@ -2477,8 +2477,6 @@ } }, "user": { - "id": "1001", - "name": "tsg", "target": { "id": "1001", "name": "tsg" @@ -2526,7 +2524,6 @@ "auth": {} }, "user": { - "name": "tsg", "target": { "name": "tsg" } @@ -4803,8 +4800,6 @@ } }, "user": { - "id": "106", - "name": "mysql", "target": { "id": "106", "name": "mysql" diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json index 5522c9c8278..36322aaaeab 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-auth.log-expected.json @@ -553,8 +553,6 @@ } }, "user": { - "id": "48", - "name": "apache", "target": { "id": "48", "name": "apache" diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json index 815f8cbb43e..60a9d90390f 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-chauthtok-iso8601.log-expected.json @@ -40,7 +40,6 @@ "auth": {} }, "user": { - "name": "user123", "target": { "name": "user123" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json index 405ab6d0c59..0f469eb5338 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-pam-extraction.log-expected.json @@ -143,7 +143,6 @@ "auth": {} }, "user": { - "name": "jsmith", "target": { "name": "jsmith" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json index 488d7384be3..6b11e992f5d 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-userdel.log-expected.json @@ -138,7 +138,6 @@ "auth": {} }, "user": { - "name": "siem_test", "target": { "name": "siem_test" } diff --git a/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json b/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json index f71fe32fba9..690ffb1df15 100644 --- a/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json +++ b/packages/system/data_stream/auth/_dev/test/pipeline/test-usermod-group.log-expected.json @@ -44,7 +44,6 @@ "auth": {} }, "user": { - "name": "testuser", "target": { "name": "testuser" } @@ -94,7 +93,6 @@ "auth": {} }, "user": { - "name": "testuser", "target": { "name": "testuser" } diff --git a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml index 29899cfcfb3..a88c2f23d01 100644 --- a/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml +++ b/packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml @@ -21,24 +21,6 @@ processors: - '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}' - '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}' - '^new user: name=%{DATA:user.target.name}, UID=%{NUMBER:user.target.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$' - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for useradd events in a future major version. - tag: set_user_name_useradd_compat - field: user.name - copy_from: user.target.name - ignore_empty_value: true - if: ctx.user?.target?.name != null - - set: - description: >- - Deprecated duplication of user.target.id for backward compatibility; - will be removed for useradd events in a future major version. - tag: set_user_id_useradd_compat - field: user.id - copy_from: user.target.id - ignore_empty_value: true - if: ctx.user?.target?.id != null - append: tag: append_category_process field: event.category @@ -192,15 +174,6 @@ processors: copy_from: _temp.usermod_user ignore_empty_value: true if: ctx._temp?.usermod_user != null - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for usermod events in a future major version. - tag: set_user_name_usermod_compat - field: user.name - copy_from: _temp.usermod_user - ignore_empty_value: true - if: ctx._temp?.usermod_user != null - set: tag: set_group_name_usermod_group field: group.name @@ -218,17 +191,6 @@ processors: copy_from: _temp.userdel_user ignore_empty_value: true if: ctx._temp?.userdel_user != null - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for userdel events in a future major version. Limited - to "delete user" messages, matching the events that populated - user.name before user.target.name was introduced. - tag: set_user_name_userdel_compat - field: user.name - copy_from: _temp.userdel_user - ignore_empty_value: true - if: ctx._temp?.userdel_user != null && ctx.message != null && ctx.message.startsWith("delete user '") - set: tag: set_group_name_userdel field: group.name @@ -445,15 +407,6 @@ processors: ignore_missing: true ignore_failure: true if: ctx._temp?.pam_user != null && ctx._temp.pam_user != '' && (ctx.user?.name == null || ctx.user?.name == '') - - set: - description: >- - Deprecated duplication of user.target.name for backward compatibility; - will be removed for password change events in a future major version. - tag: set_user_name_pam_target_compat - field: user.name - copy_from: _temp.pam_target - ignore_empty_value: true - if: ctx._temp?.pam_target != null && ctx._temp.pam_target != '' && (ctx.user?.name == null || ctx.user?.name == '') - set: tag: set_user_target_name_chauthtok field: user.target.name diff --git a/packages/system/manifest.yml b/packages/system/manifest.yml index f1f83299227..73af1a23d10 100644 --- a/packages/system/manifest.yml +++ b/packages/system/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.4.0 name: system title: System -version: "2.22.0" +version: "3.0.0" description: Collect system logs and metrics from your servers with Elastic Agent. type: integration categories: