integrations/packages/gigamon/data_stream/ami/_dev/test/pipeline/test-cef.json-expected.json at bfb883f835354a1794cac60d5121ffeb9c71f4a8 · elastic/integrations · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
{
    "expected": [
        {
            "destination": {
                "bytes": 575,
                "ip": "10.114.82.48",
                "mac": "00-50-56-9D-7F-9B",
                "packets": 5,
                "port": 9200
            },
            "ecs": {
                "version": "8.11.0"
            },
            "event": {
                "category": [
                    "network"
                ],
                "end": "2026-04-27T17:41:54.659Z",
                "kind": "event",
                "start": "2026-04-27T17:41:51.651Z",
                "type": [
                    "info"
                ]
            },
            "gigamon": {
                "ami": {
                    "app_id": "67",
                    "app_name": "elasticsearch",
                    "app_tags": "Enterprise",
                    "dst_bytes": 575,
                    "dst_ip": "10.114.82.48",
                    "dst_mac": "00:50:56:9d:7f:9b",
                    "dst_packets": 5,
                    "dst_port": 9200,
                    "egress_intf_id": "0",
                    "end_reason": "3",
                    "end_reason_value": "End of Flow",
                    "end_time": "2026-04-27T17:41:54.659Z",
                    "http_code": 200,
                    "http_host": "10.114.82.48:9200",
                    "http_method": "POST",
                    "http_server": "10.114.82.48",
                    "http_uri_path": "/_bulk",
                    "http_version": "1.1",
                    "intf_name": "0",
                    "ip_version": "4",
                    "protocol": "6",
                    "seq_num": 1160592,
                    "src_bytes": 11810,
                    "src_ip": "10.114.82.184",
                    "src_mac": "00:50:56:9d:49:ec",
                    "src_packets": 13,
                    "src_port": 33100,
                    "start_time": "2026-04-27T17:41:51.651Z",
                    "sys_up_time_first": 899345728,
                    "sys_up_time_last": 899348736,
                    "tcp_rtt_app_max": 0.015634,
                    "tcp_rtt_app_min": 0.007603,
                    "tcp_rtt_max": 2.85E-4,
                    "tcp_rtt_min": 2.85E-4
                }
            },
            "host": {
                "name": "10.114.82.48:9200"
            },
            "http": {
                "request": {
                    "method": "POST"
                },
                "response": {
                    "status_code": 200
                },
                "version": "1.1"
            },
            "network": {
                "protocol": "elasticsearch"
            },
            "server": {
                "domain": "10.114.82.48"
            },
            "service": {
                "id": "67"
            },
            "source": {
                "bytes": 11810,
                "ip": "10.114.82.184",
                "mac": "00-50-56-9D-49-EC",
                "packets": 13,
                "port": 33100
            },
            "tags": [
                "preserve_original_event",
                "_geoip_database_unavailable_GeoLite2-City.mmdb",
                "_geoip_database_unavailable_GeoLite2-ASN.mmdb",
                "_geoip_database_unavailable_GeoLite2-City.mmdb",
                "_geoip_database_unavailable_GeoLite2-ASN.mmdb"
            ],
            "url": {
                "path": "/_bulk"
            }
        }
    ]
}