:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
This report summarizes scanner evidence for elastic/beats, a Go project with 12,649 GitHub stars. SynthScan examined 2,511,955 lines of code across 14089 source files, recording 8061 pattern matches distributed across 20 syntactic categories. The legacy adjusted pattern signal is 3.3 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 7095 finding(s).
Are imports declared and package/API names verified? 912 finding(s).
Are wrappers, guards, and repeated structures necessary? 235 finding(s).
Which changes need focused human review? 8061 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 8061 distinct pattern matches across 20 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | magefile.go | 1 | // Licensed to Elasticsearch B.V. under one or more contributor | COMMENT |
| LOW | tools/tools.go | 1 | // Licensed to Elasticsearch B.V. under one or more contributor | COMMENT |
| LOW | licenses/ELASTIC-LICENSE-2.0-header.txt | 1 | // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | COMMENT |
| LOW | licenses/ELASTIC-LICENSE-header.txt | 1 | // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | COMMENT |
| LOW | licenses/license_header.go | 1 | // Licensed to Elasticsearch B.V. under one or more contributor | COMMENT |
| LOW | licenses/license_header.go | 21 | COMMENT | |
| LOW | licenses/license.go | 1 | // Licensed to Elasticsearch B.V. under one or more contributor | COMMENT |
| LOW | licenses/APACHE-LICENSE-2.0-header.txt | 1 | // Licensed to Elasticsearch B.V. under one or more contributor | COMMENT |
| LOW | …1780480871-heartbeat-synthetics-apm-crosslink-env.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …ragments/1791570000-heartbeat-named-secret-stores.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …ragments/1791570000-heartbeat-named-secret-stores.yaml | 21 | description: > | COMMENT |
| LOW | …nts/1787591085-heartbeat-receiver-scheduler-group.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …099380-fix-winlogbeat-powershell-parameterbinding.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …099380-fix-winlogbeat-powershell-parameterbinding.yaml | 41 | # If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added. | COMMENT |
| LOW | …39-fix-lock-inversion-in-the-otel-registry-bridge.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …39-fix-lock-inversion-in-the-otel-registry-bridge.yaml | 41 | # NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number. | COMMENT |
| LOW | …lowed_hosts-to-heartbeat-secret-store-connections.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …lowed_hosts-to-heartbeat-secret-store-connections.yaml | 41 | # NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number. | COMMENT |
| LOW | …/1785500000-filestream-shared-harvester-scheduler.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …/1785500000-filestream-shared-harvester-scheduler.yaml | 21 | component: filebeat | COMMENT |
| LOW | …ents/1782129391-filestream-optimize-file-scanning.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …og/fragments/1791521396-pgsql-null-column-datarow.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …log/fragments/1792643522-okta-minimal-scratch-dir.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …log/fragments/1792643522-okta-minimal-scratch-dir.yaml | 41 | # If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added. | COMMENT |
| LOW | …1784567309-filestream-multiline-timeout-goroutine.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …ts/1788982248-filestream-cache-directory-listings.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …ments/1793193287-fix-synthexec-start-failure-leak.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …ments/1793193287-fix-synthexec-start-failure-leak.yaml | 21 | # description: | COMMENT |
| LOW | …ments/1793193287-fix-synthexec-start-failure-leak.yaml | 41 | # AUTOMATED | COMMENT |
| LOW | changelog/fragments/1791837294-update-go-to-1.26.9.yaml | 1 | # REQUIRED | COMMENT |
| LOW | changelog/fragments/1791837294-update-go-to-1.26.9.yaml | 21 | # description: | COMMENT |
| LOW | changelog/fragments/1791837294-update-go-to-1.26.9.yaml | 41 | # AUTOMATED | COMMENT |
| LOW | …s/1783332050-filestream-fd-exhaustion-no-reingest.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …/fragments/1791967689-linereader-spin-after-close.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …/fragments/1791967689-linereader-spin-after-close.yaml | 21 | # description: | COMMENT |
| LOW | …/fragments/1791967689-linereader-spin-after-close.yaml | 41 | # AUTOMATED | COMMENT |
| LOW | …rve-literal-dotted-keys-in-browser-monitor-params.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …rve-literal-dotted-keys-in-browser-monitor-params.yaml | 21 | # description: | COMMENT |
| LOW | …rve-literal-dotted-keys-in-browser-monitor-params.yaml | 41 | # pr: https://github.com/owner/repo/1234 | COMMENT |
| LOW | …gments/1781543752-filestream-park-idle-harvesters.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …gments/1781543752-filestream-park-idle-harvesters.yaml | 21 | component: filebeat | COMMENT |
| LOW | …gments/1787349887-input-cursor-shared-state-store.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …agments/1792776648-logstash-exporter-fifo-enqueue.yaml | 1 | # Kind can be one of: | COMMENT |
| LOW | …305201-update-github.com-apache-thrift-to-v0.25.0.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …305201-update-github.com-apache-thrift-to-v0.25.0.yaml | 21 | # description: | COMMENT |
| LOW | …305201-update-github.com-apache-thrift-to-v0.25.0.yaml | 41 | # AUTOMATED | COMMENT |
| LOW | …7256-fix-malformed-synthetics-runner-log-messages.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …7256-fix-malformed-synthetics-runner-log-messages.yaml | 21 | # description: | COMMENT |
| LOW | …7256-fix-malformed-synthetics-runner-log-messages.yaml | 41 | # AUTOMATED | COMMENT |
| LOW | …og/fragments/1792574798-autoops-es-min-search-vcu.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …og/fragments/1792574798-autoops-es-min-search-vcu.yaml | 21 | # description: | COMMENT |
| LOW | …og/fragments/1792574798-autoops-es-min-search-vcu.yaml | 41 | # AUTOMATED | COMMENT |
| LOW | …ragments/1792532859-bound-osquery-outage-recovery.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …ragments/1792532859-bound-osquery-outage-recovery.yaml | 21 | # description: | COMMENT |
| LOW | …ragments/1792532859-bound-osquery-outage-recovery.yaml | 41 | # AUTOMATED | COMMENT |
| LOW | …e-identically-configured-processors-across-inputs.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …e-identically-configured-processors-across-inputs.yaml | 21 | description: > | COMMENT |
| LOW | …angelog/fragments/1784889342-remove-system-hostfs.yaml | 1 | # REQUIRED | COMMENT |
| LOW | …angelog/fragments/1784889342-remove-system-hostfs.yaml | 21 | # description: | COMMENT |
| LOW | …angelog/fragments/1784889342-remove-system-hostfs.yaml | 41 | # AUTOMATED | COMMENT |
| 6673 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | filebeat/module/logstash/log/ingest/pipeline-json.yml | 40 | ctx.logstash.log.log_event.action.forEach(v -> { | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 997 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 998 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 999 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1000 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1001 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1002 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL | …/elasticsearch/server/test/test-json.log-expected.json | 1019 | "at org.elasticsearch.common.logging.JsonLoggerTests.testJsonInStacktraceMessageIsSplitted(JsonLoggerTests.j | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1077 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1078 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1079 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1080 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1081 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL⚡ | …/elasticsearch/server/test/test-json.log-expected.json | 1082 | "at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36) [randomized | CODE |
| CRITICAL | …/elasticsearch/server/test/test-json.log-expected.json | 1099 | "at org.elasticsearch.common.logging.JsonLoggerTests.testStacktrace(JsonLoggerTests.java:125) [test/:?]", | CODE |
| CRITICAL | …odule/elasticsearch/server/test/test.log-expected.json | 247 | "message": "path: /_xpack/monitoring/_bulk, params: {system_id=logstash, system_api_version=2, interval=1s}\norg | CODE |
| CRITICAL | …odule/elasticsearch/server/test/test.log-expected.json | 345 | "message": "monitoring execution failed\norg.elasticsearch.xpack.monitoring.exporter.ExportException: Exception | CODE |
| CRITICAL | filebeat/module/apache/access/ingest/pipeline.yml | 101 | def parts = ctx.apache.access.ssl.protocol.toLowerCase().splitOnToken("v"); | CODE |
| CRITICAL⚡ | docs/reference/filebeat/multiline-examples.md | 54 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:1 | CODE |
| CRITICAL⚡ | docs/reference/filebeat/multiline-examples.md | 55 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:7 | CODE |
| CRITICAL⚡ | docs/reference/filebeat/multiline-examples.md | 56 | at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.ja | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 233 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:1 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 234 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:7 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 235 | at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.ja | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 238 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:1 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 239 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:7 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 240 | at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.ja | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 245 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:1 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 246 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:7 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 247 | at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.ja | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 251 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:1 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 252 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:7 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 253 | at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.ja | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 278 | <165>1 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - at org.elasticsearch.cluster.metadata.IndexNameExp | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 279 | <165>1 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - at org.elasticsearch.cluster.metadata.IndexNameExp | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 280 | <165>1 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - at org.elasticsearch.action.admin.indices.delete.T | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 284 | <165>1 2003-08-24T05:14:30.000003-07:00 192.0.2.1 myproc 8710 - - at org.elasticsearch.cluster.metadata.IndexNameExp | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 285 | <165>1 2003-08-24T05:14:30.000003-07:00 192.0.2.1 myproc 8710 - - at org.elasticsearch.cluster.metadata.IndexNameExp | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 286 | <165>1 2003-08-24T05:14:30.000003-07:00 192.0.2.1 myproc 8710 - - at org.elasticsearch.action.admin.indices.delete.T | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 291 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:1 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 292 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:7 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 293 | at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.ja | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 299 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:1 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 300 | at org.elasticsearch.cluster.metadata.IndexNameExpressionResolver.concreteIndices(IndexNameExpressionResolver.java:7 | CODE |
| CRITICAL⚡ | libbeat/reader/parser/parser_test.go | 301 | at org.elasticsearch.action.admin.indices.delete.TransportDeleteIndexAction.checkBlock(TransportDeleteIndexAction.ja | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 228 | at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:426) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 229 | at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:687) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 233 | at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 250 | at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:426) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 251 | at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:687) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 255 | at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 307 | at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:426) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 308 | at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:687) | CODE |
| CRITICAL⚡ | libbeat/processors/dissect/dissect_test.go | 312 | at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) | CODE |
| CRITICAL | libbeat/processors/dissect/testdata/dissect_tests.json | 18 | "msg": "18-Apr-2018 06:53:20.411 INFO [http-nio-8080-exec-1] org.apache.coyote.http11.Http11Processor.service Error pa | CODE |
| CRITICAL | libbeat/processors/dissect/testdata/dissect_tests.json | 22 | "message": "Error parsing HTTP request header\n Note: further occurrences of HTTP header parsing errors will be logge | CODE |
| CRITICAL | x-pack/filebeat/input/awss3/v2_processor.go | 413 | event.SetID(fmt.Sprintf("%d-%s-%012d", b.obj.S3.Object.LastModified.UnixNano(), b.hash, offset)) | CODE |
| CRITICAL | …at/module/activemq/log/test/activemq.log-expected.json | 73 | "activemq.log.stack_trace": "at org.apache.activemq.util.IOExceptionSupport.create(IOExceptionSupport.java:28)[a | CODE |
| CRITICAL | …filebeat/module/azure/activitylogs/ingest/pipeline.yml | 229 | for (String key : ctx.azure.activitylogs.identity.claims.keySet()) { | CODE |
| CRITICAL | …filebeat/module/azure/activitylogs/ingest/pipeline.yml | 230 | ctx.temp_claims[key.replace('.', '_')] = ctx.azure.activitylogs.identity.claims.get(key); | CODE |
| 6 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …search/cluster_stats/_meta/test/cluster_state.710.json | 7124 | "placeholder": { | CODE |
| LOW | …sticsearch/index/_meta/test/cluster_state.7.17.27.json | 6341 | "placeholder" : { | CODE |
| LOW | docs/reference/filebeat/filebeat-input-httpjson.md | 1433 | Note that since `request.url` must be a valid URL, if an API returns complete URLs in place of an identifier as in t | CODE |
| LOW | docs/reference/filebeat/filebeat-input-httpjson.md | 1681 | Note that since `request.url` must be a valid URL, if an API returns complete URLs in place of an identifier as in t | CODE |
| LOW⚡ | …reference/filebeat/filebeat-module-google_workspace.md | 70 | var.delegated_account: "user@example.com" | CODE |
| LOW⚡ | …reference/filebeat/filebeat-module-google_workspace.md | 74 | var.delegated_account: "user@example.com" | CODE |
| LOW⚡ | …reference/filebeat/filebeat-module-google_workspace.md | 78 | var.delegated_account: "user@example.com" | CODE |
| LOW⚡ | …reference/filebeat/filebeat-module-google_workspace.md | 82 | var.delegated_account: "user@example.com" | CODE |
| LOW⚡ | …reference/filebeat/filebeat-module-google_workspace.md | 86 | var.delegated_account: "user@example.com" | CODE |
| LOW⚡ | …reference/filebeat/filebeat-module-google_workspace.md | 90 | var.delegated_account: "user@example.com" | CODE |
| LOW | docs/reference/libbeat/config-file-format.md | 47 | person: {name: "John Doe", age: 34, country: "Canada"} | CODE |
| LOW | libbeat/processors/dissect/testdata/dissect_tests.json | 180 | "name": "Jane Doe", | CODE |
| LOW | …rocessors/add_cloud_metadata/provider_azure_vm_test.go | 133 | return azcore.AccessToken{Token: "fake_token", ExpiresOn: time.Now().Add(24 * time.Hour)}, nil | CODE |
| LOW | …processors/add_host_metadata/add_host_metadata_test.go | 779 | hostname := "placeholder" | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 44 | var mixedContent = makeContent("mixed", `Lorem ipsum dolor sit amet, | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 44 | var mixedContent = makeContent("mixed", `Lorem ipsum dolor sit amet, | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 60 | var logContent = makeContent("simple_log", `23-08-2016 15:10:01 - Lorem ipsum dolor sit amet, | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 60 | var logContent = makeContent("simple_log", `23-08-2016 15:10:01 - Lorem ipsum dolor sit amet, | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 73 | var logContent2 = makeContent("simple_log2", `2016-08-23 15:10:01 - DEBUG - Lorem ipsum dolor sit amet, | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 73 | var logContent2 = makeContent("simple_log2", `2016-08-23 15:10:01 - DEBUG - Lorem ipsum dolor sit amet, | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 85 | var logContentLevel = makeContent("simple_log_with_level", `DEBUG - 2016-08-23 15:10:01 - Lorem ipsum dolor sit amet, | CODE |
| LOW | libbeat/common/match/matcher_bench_test.go | 85 | var logContentLevel = makeContent("simple_log_with_level", `DEBUG - 2016-08-23 15:10:01 - Lorem ipsum dolor sit amet, | CODE |
| LOW | x-pack/filebeat/input/gcppubsub/testdata/fake.json | 6 | "client_email": "foo@bar.com", | CODE |
| LOW | x-pack/filebeat/input/httpjson/config_test.go | 509 | "client_email": "foo@bar.com", | CODE |
| LOW | x-pack/filebeat/input/httpjson/config_test.go | 524 | "client_email": "foo@bar.com", | CODE |
| LOW | …pack/filebeat/input/httpjson/testdata/credentials.json | 5 | "client_email": "foo@bar.com", | CODE |
| LOW | …ilebeat/input/salesforce/live_activity_helpers_test.go | 1339 | keySalesforceUsername: "user@example.com", | CODE |
| LOW | …ilebeat/input/salesforce/live_activity_helpers_test.go | 1351 | assert.Equal(t, "user@example.com", creds.Username) | CODE |
| LOW | …ilebeat/input/salesforce/live_activity_helpers_test.go | 1427 | assert.Equal(t, "user@example.com", creds.Username) | CODE |
| LOW | …ilebeat/input/salesforce/live_activity_helpers_test.go | 1438 | keySalesforceUsername: "'user@example.com'", | CODE |
| LOW | …ilebeat/input/salesforce/live_activity_helpers_test.go | 1450 | assert.Equal(t, "user@example.com", creds.Username) | CODE |
| LOW | x-pack/filebeat/input/cel/config_test.go | 689 | "client_email": "foo@bar.com", | CODE |
| LOW | x-pack/filebeat/input/cel/config_test.go | 704 | "client_email": "foo@bar.com", | CODE |
| LOW | x-pack/filebeat/input/cel/testdata/credentials.json | 5 | "client_email": "foo@bar.com", | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 6 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 36 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 155 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 185 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 304 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 335 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 454 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 485 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 604 | "asr@example.org" | CODE |
| LOW | …dule/o365/audit/test/13-dlp-exchange.log-expected.json | 634 | "asr@example.org" | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 40 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 88 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 136 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 184 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 232 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 280 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 328 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …ccounts/test/user_accounts-test.json.log-expected.json | 376 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 41 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 90 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 142 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 191 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 240 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 289 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 338 | "source.user.email": "foo@bar.com", | CODE |
| LOW | …/admin/test/admin-calendar-test.json.log-expected.json | 391 | "source.user.email": "foo@bar.com", | CODE |
| 613 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | metricbeat/module/postgresql/test_postgresql.py | 4 | CODE | |
| LOW | metricbeat/module/openmetrics/test_openmetrics.py | 2 | CODE | |
| LOW | metricbeat/module/openmetrics/test_openmetrics.py | 3 | CODE | |
| LOW | metricbeat/module/docker/test_docker.py | 2 | CODE | |
| LOW | metricbeat/module/docker/test_docker.py | 3 | CODE | |
| LOW | metricbeat/module/couchdb/test_couchdb.py | 2 | CODE | |
| LOW | metricbeat/module/couchdb/test_couchdb.py | 3 | CODE | |
| LOW | metricbeat/module/vsphere/test_vsphere.py | 2 | CODE | |
| LOW | metricbeat/module/vsphere/test_vsphere.py | 3 | CODE | |
| LOW | metricbeat/module/kibana/test_kibana.py | 5 | CODE | |
| LOW | metricbeat/module/php_fpm/test_phpfpm.py | 2 | CODE | |
| LOW | metricbeat/module/php_fpm/test_phpfpm.py | 3 | CODE | |
| LOW | metricbeat/module/logstash/test_logstash.py | 3 | CODE | |
| LOW | metricbeat/module/logstash/test_logstash.py | 5 | CODE | |
| LOW | metricbeat/module/logstash/test_logstash.py | 6 | CODE | |
| LOW | metricbeat/module/redis/test_redis.py | 2 | CODE | |
| LOW | metricbeat/module/redis/test_redis.py | 5 | CODE | |
| LOW | metricbeat/module/golang/test_golang.py | 2 | CODE | |
| LOW | metricbeat/module/golang/test_golang.py | 4 | CODE | |
| LOW | metricbeat/module/ceph/test_ceph.py | 2 | CODE | |
| LOW | metricbeat/module/ceph/test_ceph.py | 4 | CODE | |
| LOW | metricbeat/module/ceph/test_ceph.py | 5 | CODE | |
| LOW | metricbeat/module/beat/test_beat.py | 1 | CODE | |
| LOW | metricbeat/module/beat/test_beat.py | 4 | CODE | |
| LOW | metricbeat/module/beat/test_beat.py | 6 | CODE | |
| LOW | metricbeat/module/munin/test_munin.py | 2 | CODE | |
| LOW | metricbeat/module/munin/test_munin.py | 3 | CODE | |
| LOW | metricbeat/module/jolokia/test_jolokia.py | 2 | CODE | |
| LOW | metricbeat/module/jolokia/test_jolokia.py | 3 | CODE | |
| LOW | metricbeat/module/mongodb/test_mongodb.py | 2 | CODE | |
| LOW | metricbeat/module/mongodb/test_mongodb.py | 4 | CODE | |
| LOW | metricbeat/module/zookeeper/test_zookeeper.py | 2 | CODE | |
| LOW | metricbeat/module/zookeeper/test_zookeeper.py | 4 | CODE | |
| LOW | metricbeat/module/memcached/test_memcached.py | 2 | CODE | |
| LOW | metricbeat/module/memcached/test_memcached.py | 3 | CODE | |
| LOW | metricbeat/module/consul/test_consul.py | 2 | CODE | |
| LOW | metricbeat/module/consul/test_consul.py | 4 | CODE | |
| LOW | metricbeat/module/http/test_http.py | 2 | CODE | |
| LOW | metricbeat/module/http/test_http.py | 4 | CODE | |
| LOW | metricbeat/module/http/test_http.py | 5 | CODE | |
| LOW | metricbeat/module/kafka/test_kafka.py | 2 | CODE | |
| LOW | metricbeat/module/kafka/test_kafka.py | 3 | CODE | |
| LOW | metricbeat/module/aerospike/test_aerospike.py | 2 | CODE | |
| LOW | metricbeat/module/aerospike/test_aerospike.py | 3 | CODE | |
| LOW | metricbeat/module/mysql/test_mysql.py | 2 | CODE | |
| LOW | metricbeat/module/mysql/test_mysql.py | 4 | CODE | |
| LOW | metricbeat/module/etcd/test_etcd.py | 2 | CODE | |
| LOW | metricbeat/module/etcd/test_etcd.py | 3 | CODE | |
| LOW | metricbeat/module/etcd/test_etcd.py | 4 | CODE | |
| LOW | metricbeat/module/envoyproxy/test_envoyproxy.py | 2 | CODE | |
| LOW | metricbeat/module/envoyproxy/test_envoyproxy.py | 3 | CODE | |
| LOW | metricbeat/module/prometheus/test_prometheus.py | 2 | CODE | |
| LOW | metricbeat/module/prometheus/test_prometheus.py | 3 | CODE | |
| LOW | metricbeat/module/uwsgi/test_uwsgi.py | 3 | CODE | |
| LOW | metricbeat/module/uwsgi/test_uwsgi.py | 5 | CODE | |
| LOW | metricbeat/module/dropwizard/test_dropwizard.py | 2 | CODE | |
| LOW | metricbeat/module/dropwizard/test_dropwizard.py | 3 | CODE | |
| LOW | metricbeat/module/apache/test_apache.py | 2 | CODE | |
| LOW | metricbeat/module/apache/test_apache.py | 5 | CODE | |
| LOW | metricbeat/module/traefik/test_traefik.py | 2 | CODE | |
| 110 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | metricbeat/module/ceph/test_ceph.py | 69 | def get_ceph_mgr_module_config(self, metricset): | CODE |
| LOW | metricbeat/module/elasticsearch/test_elasticsearch.py | 223 | def create_ccr_follower_index(self): | CODE |
| LOW | metricbeat/module/elasticsearch/test_elasticsearch.py | 249 | def create_enrich_source_index(self): | CODE |
| LOW | metricbeat/module/elasticsearch/test_elasticsearch.py | 274 | def create_enrich_ingest_pipeline(self): | CODE |
| LOW | metricbeat/module/elasticsearch/test_elasticsearch.py | 302 | def delete_enrich_ingest_pipeline(self): | CODE |
| LOW | metricbeat/tests/system/test_processors.py | 53 | def test_dropfields_with_condition(self): | CODE |
| LOW | metricbeat/tests/system/test_processors.py | 90 | def test_dropevent_with_condition(self): | CODE |
| LOW | metricbeat/tests/system/test_processors.py | 130 | def test_dropevent_with_complex_condition(self): | CODE |
| LOW | metricbeat/tests/system/test_processors.py | 251 | def test_contradictory_multiple_actions(self): | CODE |
| LOW | metricbeat/tests/system/test_cmd.py | 127 | def test_modules_test_with_module_in_main_config(self): | CODE |
| LOW | metricbeat/tests/system/test_cmd.py | 166 | def test_modules_test_filter_no_result(self): | CODE |
| LOW | metricbeat/tests/system/metricbeat.py | 69 | def assert_fields_for_platform(self, good_fields: object, written_fields: object): | CODE |
| LOW | metricbeat/tests/system/metricbeat.py | 81 | def assert_no_logged_warnings(self, replace=None): | CODE |
| LOW | metricbeat/tests/system/metricbeat.py | 165 | def parameterized_with_supported_versions(base_class): | CODE |
| LOW | metricbeat/tests/system/test_reload.py | 96 | def test_wrong_module_no_reload(self): | STRING |
| LOW | filebeat/conftest.py | 31 | def pytest_collection_modifyitems(config, items): | CODE |
| LOW⚡ | filebeat/tests/system/test_unix.py | 19 | def test_unix_with_newline_delimiter(self): | CODE |
| LOW⚡ | filebeat/tests/system/test_unix.py | 25 | def test_unix_with_custom_char_delimiter(self): | CODE |
| LOW⚡ | filebeat/tests/system/test_unix.py | 31 | def test_unix_with_custom_word_delimiter(self): | CODE |
| LOW⚡ | filebeat/tests/system/test_unix.py | 37 | def send_events_with_delimiter(self, delimiter): | CODE |
| LOW | filebeat/tests/system/test_unix.py | 77 | def test_unix_datagram_socket(self): | STRING |
| LOW | filebeat/tests/system/test_processors.py | 44 | def test_dissect_good_tokenizer(self): | CODE |
| LOW | filebeat/tests/system/test_processors.py | 94 | def test_dissect_bad_tokenizer(self): | CODE |
| LOW | filebeat/tests/system/test_processors.py | 175 | def test_decode_csv_fields_defaults(self): | CODE |
| LOW | filebeat/tests/system/test_processors.py | 200 | def test_decode_csv_fields_all_options(self): | CODE |
| LOW | filebeat/tests/system/test_processors.py | 252 | def test_javascript_processor_add_host_metadata(self): | CODE |
| LOW | filebeat/tests/system/test_processors.py | 269 | def _test_javascript_processor_with_source(self, script_source): | STRING |
| LOW | filebeat/tests/system/test_processors.py | 288 | def _init_and_read_test_input(self, input_lines): | STRING |
| LOW | filebeat/tests/system/test_index_pattern.py | 8 | def test_export_index_pattern(self): | CODE |
| LOW | filebeat/tests/system/test_index_pattern.py | 21 | def test_export_index_pattern_migration(self): | CODE |
| LOW | filebeat/tests/system/test_setup.py | 26 | def test_setup_modules_d_config(self): | CODE |
| LOW | filebeat/tests/system/test_reload_modules.py | 72 | def test_reload_writes_pipeline(self): | STRING |
| LOW | filebeat/tests/system/test_reload_modules.py | 220 | def test_wrong_module_no_reload(self): | STRING |
| LOW | filebeat/tests/system/test_input.py | 17 | def test_rotating_close_inactive_larger_write_rate(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 72 | def test_close_inactive_file_removal(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 115 | def test_close_inactive_file_rotation_and_removal(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 266 | def test_input_filter_dropfields(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 291 | def test_input_filter_includefields(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 316 | def test_restart_recursive_glob(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 354 | def test_disable_recursive_glob(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 374 | def test_input_processing_pipeline_disable_host(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 394 | def test_path_based_identity_tracking(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 424 | def test_inode_marker_based_identity_tracking(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 458 | def test_inode_marker_based_identity_tracking_to_path_based(self): | CODE |
| LOW | filebeat/tests/system/test_input.py | 499 | def __write_hello_word_to_test_input_file(self, testfile): | CODE |
| LOW | filebeat/tests/system/test_shutdown.py | 103 | def test_shutdown_wait_timeout(self, queue_type): | CODE |
| LOW | filebeat/tests/system/test_syslog.py | 56 | def test_syslog_with_tcp_invalid_message(self): | STRING |
| LOW⚡ | filebeat/tests/system/test_syslog.py | 139 | def test_syslog_with_unix_stream(self): | STRING |
| LOW⚡ | filebeat/tests/system/test_syslog.py | 149 | def test_syslog_with_unix_datagram(self): | STRING |
| LOW⚡ | filebeat/tests/system/test_syslog.py | 156 | def run_filebeat_and_send_using_socket(self, socket_type, send_over_socket): | STRING |
| LOW⚡ | filebeat/tests/system/test_syslog.py | 204 | def test_syslog_with_unix_stream_invalid_message(self): | STRING |
| LOW⚡ | filebeat/tests/system/test_syslog.py | 214 | def test_syslog_with_unix_datagram_invalid_message(self): | STRING |
| LOW⚡ | filebeat/tests/system/test_syslog.py | 221 | def run_filebeat_and_send_invalid_message_using_socket(self, socket_type, send_over_socket): | STRING |
| LOW | filebeat/tests/system/test_registrar.py | 22 | def test_registrar_file_content(self): | CODE |
| LOW | filebeat/tests/system/test_registrar.py | 127 | def test_custom_registry_file_location(self): | CODE |
| LOW | filebeat/tests/system/test_registrar.py | 152 | def test_registry_file_default_permissions(self): | CODE |
| LOW | filebeat/tests/system/test_registrar.py | 186 | def test_registry_file_custom_permissions(self): | CODE |
| LOW | filebeat/tests/system/test_registrar.py | 221 | def test_registry_file_update_permissions(self): | CODE |
| LOW | filebeat/tests/system/test_registrar.py | 526 | def test_rotating_file_with_restart(self): | CODE |
| LOW | filebeat/tests/system/test_registrar.py | 632 | def test_state_after_rotation(self): | CODE |
| 121 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | metricbeat/metricbeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | metricbeat/metricbeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| MEDIUM | filebeat/filebeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| MEDIUM | filebeat/filebeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | winlogbeat/winlogbeat.reference.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | winlogbeat/winlogbeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | …ts/docker/elasticsearch_kerberos/scripts/installkdc.sh | 81 | # Create a link so addprinc.sh is on path | COMMENT |
| MEDIUM | …vironments/docker/elasticsearch/kerberos/installkdc.sh | 72 | # Create a link so addprinc.sh is on path | COMMENT |
| MEDIUM | …/environments/docker/elasticsearch/pki/generate_pki.sh | 2 | # Create the sha256 fingerprint for the CA certificate | COMMENT |
| MEDIUM | heartbeat/heartbeat.yml | 3 | # This file is an example configuration file highlighting only some common options. | COMMENT |
| MEDIUM | heartbeat/heartbeat.yml | 12 | # Define a directory from which to load monitor definitions. Definitions take the form | COMMENT |
| MEDIUM | heartbeat/heartbeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| MEDIUM | heartbeat/heartbeat.reference.yml | 13 | # Define a directory from which to load monitor definitions. Definitions take the form | COMMENT |
| MEDIUM | heartbeat/heartbeat.reference.yml | 74 | # Define a directory to load monitor definitions from. Definitions take the form | COMMENT |
| MEDIUM | heartbeat/heartbeat.docker.yml | 1 | # Define a directory to load monitor definitions from. Definitions take the form | COMMENT |
| MEDIUM | packetbeat/packetbeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | packetbeat/packetbeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| MEDIUM | dev-tools/packaging/packages.yml | 2 | # This file contains the package specifications for both Community Beats and | COMMENT |
| MEDIUM | x-pack/osquerybeat/dev-tools/packaging/packages.yml | 3 | # This file contains the package specifications for Osquerybeat. | COMMENT |
| MEDIUM | x-pack/metricbeat/metricbeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | x-pack/metricbeat/metricbeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| MEDIUM | x-pack/filebeat/filebeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| MEDIUM | x-pack/filebeat/filebeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | x-pack/filebeat/input/netflow/fields_gen.go | 138 | writeLine(out, "# This file is generated. Do not modify.") | CODE |
| MEDIUM | x-pack/filebeat/input/netflow/_meta/fields.yml | 2 | # This file is generated. Do not modify. | COMMENT |
| MEDIUM | …nput/awscloudwatch/_meta/terraform/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | …lebeat/input/awss3/_meta/terraform/.terraform.lock.hcl | 1 | # This file is maintained automatically by "terraform init". | COMMENT |
| MEDIUM | x-pack/winlogbeat/winlogbeat.reference.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | x-pack/winlogbeat/winlogbeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | x-pack/heartbeat/heartbeat.yml | 3 | # This file is an example configuration file highlighting only some common options. | COMMENT |
| MEDIUM | x-pack/heartbeat/heartbeat.yml | 12 | # Define a directory from which to load monitor definitions. Definitions take the form | COMMENT |
| MEDIUM | x-pack/heartbeat/heartbeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| MEDIUM | x-pack/heartbeat/heartbeat.reference.yml | 13 | # Define a directory from which to load monitor definitions. Definitions take the form | COMMENT |
| MEDIUM | x-pack/heartbeat/heartbeat.reference.yml | 74 | # Define a directory to load monitor definitions from. Definitions take the form | COMMENT |
| MEDIUM | x-pack/heartbeat/heartbeat.docker.yml | 1 | # Define a directory to load monitor definitions from. Definitions take the form | COMMENT |
| MEDIUM | x-pack/packetbeat/packetbeat.yml | 3 | # This file is an example configuration file highlighting only the most common | COMMENT |
| MEDIUM | x-pack/packetbeat/packetbeat.reference.yml | 3 | # This file is a full configuration example documenting all non-deprecated | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | libbeat/otel/otelconsumer/otelconsumer_test.go | 659 | // ── Beats ES output path ────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 342 | // ├──────────────────────────────────────────┼─────────────┼───────────── | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 345 | // │◀───────────────────────(5min)────────────┼────────────▶│ | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 348 | // │◀───────────────────────(5min)─────────────────────────▶│ | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 365 | // |◀───────────────────────(5min)─────────────────────────▶│ | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 367 | // ├────────────────────────────────────────────────────────┼───────────── | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 370 | // |◀───────────────────────(5min)─────────────────────────▶│ | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 373 | // │◀───────────────────────(5min)─────────────────────────▶│ | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 391 | // ├──────────────────────────────────────────┼─────────────┼───────────── | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 394 | // |◀───────────────────────(60min)────────────────────────▶│ | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 397 | // │◀───────────────────────(PT1H)────────────┼────────────▶│ | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 417 | // ├──────────────────────────────────────────┼─────────────┼──────────────| | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 420 | // |◀───────────────────────(5min)─────────────────────────▶│ | | COMMENT |
| MEDIUM⚡ | x-pack/metricbeat/module/azure/azure.go | 423 | // │◀───────────────────────(5min)─────────────────────────▶| │ | COMMENT |
| MEDIUM | x-pack/heartbeat/hbreceiver/smoke_test.go | 31 | // ── helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/heartbeat/hbreceiver/smoke_test.go | 134 | // ── HTTP monitor tests ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/heartbeat/hbreceiver/smoke_test.go | 318 | // ── TCP monitor tests ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/heartbeat/hbreceiver/smoke_test.go | 361 | // ── ICMP monitor tests ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/heartbeat/hbreceiver/smoke_test.go | 387 | // ── Monitor lifecycle tests ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/heartbeat/hbreceiver/smoke_test.go | 411 | // ── Event field tests ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/heartbeat/hbreceiver/smoke_test.go | 534 | // ── Dynamic config reload tests ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/libbeat/common/identityfederation/aws.go | 45 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/libbeat/common/identityfederation/aws.go | 47 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/libbeat/common/identityfederation/aws.go | 118 | // ────────────────────────────────────────────── | COMMENT |
| MEDIUM | x-pack/libbeat/common/identityfederation/aws.go | 120 | // ────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docs/reference/loggingplugin/log-driver-installation.md | 22 | ## Step 1: Install the Elastic Logging Plugin plugin [_step_1_install_the_elastic_logging_plugin_plugin] | COMMENT |
| LOW | docs/reference/loggingplugin/log-driver-installation.md | 62 | ## Step 2: Configure the Elastic Logging Plugin [_step_2_configure_the_elastic_logging_plugin] | COMMENT |
| LOW | …ce/metricbeat/metricbeat-installation-configuration.md | 51 | ## Step 1: Install Metricbeat [install] | COMMENT |
| LOW | …ce/metricbeat/metricbeat-installation-configuration.md | 141 | ## Step 2: Connect to the {{stack}} [set-connection] | COMMENT |
| LOW | …ce/metricbeat/metricbeat-installation-configuration.md | 211 | ## Step 3: Enable and configure metrics collection modules [enable-modules] | COMMENT |
| LOW | …ce/metricbeat/metricbeat-installation-configuration.md | 315 | ## Step 4: Set up assets | COMMENT |
| LOW | …ce/metricbeat/metricbeat-installation-configuration.md | 376 | ## Step 5: Start Metricbeat | COMMENT |
| LOW | …ce/metricbeat/metricbeat-installation-configuration.md | 457 | ## Step 6: View your data in {{kib}} [view-data] | COMMENT |
| LOW | docs/reference/filebeat/migrate-to-filestream.md | 110 | ### Step 1: Unique identifiers [step_1] | COMMENT |
| LOW | docs/reference/filebeat/migrate-to-filestream.md | 151 | ### Step 2: The "take over" mode [step_2] | COMMENT |
| LOW | docs/reference/filebeat/migrate-to-filestream.md | 238 | ### Step 3: Migrate additional parameters if necessary [step_3] | COMMENT |
| LOW | docs/reference/filebeat/migrate-to-filestream.md | 379 | ### Step 4: Validating the migration [step_4] | COMMENT |
| LOW | …erence/filebeat/filebeat-installation-configuration.md | 48 | ## Step 1: Install Filebeat [installation] | COMMENT |
| LOW | …erence/filebeat/filebeat-installation-configuration.md | 136 | ## Step 2: Connect to the {{stack}} [set-connection] | COMMENT |
| LOW | …erence/filebeat/filebeat-installation-configuration.md | 208 | ## Step 3: Collect log data [collect-log-data] | COMMENT |
| LOW | …erence/filebeat/filebeat-installation-configuration.md | 341 | ## Step 4: Set up assets [setup-assets] | COMMENT |
| LOW | …erence/filebeat/filebeat-installation-configuration.md | 412 | ## Step 5: Start Filebeat [start] | COMMENT |
| LOW | …erence/filebeat/filebeat-installation-configuration.md | 487 | ## Step 6: View your data in {{kib}} [view-data] | COMMENT |
| LOW | …ence/auditbeat/auditbeat-installation-configuration.md | 45 | ## Step 1: Install Auditbeat [install] | COMMENT |
| LOW | …ence/auditbeat/auditbeat-installation-configuration.md | 134 | ## Step 2: Connect to the {{stack}} [set-connection] | COMMENT |
| LOW | …ence/auditbeat/auditbeat-installation-configuration.md | 200 | ## Step 3: Configure data collection modules [enable-modules] | COMMENT |
| LOW | …ence/auditbeat/auditbeat-installation-configuration.md | 234 | ## Step 4: Set up assets [setup-assets] | COMMENT |
| LOW | …ence/auditbeat/auditbeat-installation-configuration.md | 295 | ## Step 5: Start Auditbeat [start] | COMMENT |
| LOW | …ence/auditbeat/auditbeat-installation-configuration.md | 370 | ## Step 6: View your data in {{kib}} [view-data] | COMMENT |
| LOW | …ce/winlogbeat/winlogbeat-installation-configuration.md | 49 | ## Step 1: Install Winlogbeat [installation] | COMMENT |
| LOW | …ce/winlogbeat/winlogbeat-installation-configuration.md | 96 | ## Step 2: Connect to the {{stack}} [set-connection] | COMMENT |
| LOW | …ce/winlogbeat/winlogbeat-installation-configuration.md | 161 | ## Step 3: Configure Winlogbeat [configuration] | COMMENT |
| LOW | …ce/winlogbeat/winlogbeat-installation-configuration.md | 205 | ## Step 4: Set up assets [setup-assets] | COMMENT |
| LOW | …ce/winlogbeat/winlogbeat-installation-configuration.md | 230 | ## Step 5: Start Winlogbeat [start] | COMMENT |
| LOW | …ce/winlogbeat/winlogbeat-installation-configuration.md | 264 | ## Step 6: View your data in {{kib}} [view-data] | COMMENT |
| LOW | …ence/heartbeat/heartbeat-installation-configuration.md | 49 | ## Step 1: Install Heartbeat [installation] | COMMENT |
| LOW | …ence/heartbeat/heartbeat-installation-configuration.md | 137 | ## Step 2: Connect to the {{stack}} [set-connection] | COMMENT |
| LOW | …ence/heartbeat/heartbeat-installation-configuration.md | 207 | ## Step 3: Configure Heartbeat monitors [configuration] | COMMENT |
| LOW | …ence/heartbeat/heartbeat-installation-configuration.md | 251 | ## Step 4: Configure the Heartbeat location [configurelocation] | COMMENT |
| LOW | …ence/heartbeat/heartbeat-installation-configuration.md | 287 | ## Step 5: Set up assets [setup-assets] | COMMENT |
| LOW | …ence/heartbeat/heartbeat-installation-configuration.md | 333 | ## Step 6: Start Heartbeat [start] | COMMENT |
| LOW | …ence/heartbeat/heartbeat-installation-configuration.md | 406 | ## Step 7: View your data in {{kib}} [view-data] | COMMENT |
| LOW | …ce/packetbeat/packetbeat-installation-configuration.md | 92 | ## Step 1: Install Packetbeat [install] | COMMENT |
| LOW | …ce/packetbeat/packetbeat-installation-configuration.md | 176 | ## Step 2: Connect to the {{stack}} [set-connection] | COMMENT |
| LOW | …ce/packetbeat/packetbeat-installation-configuration.md | 246 | ## Step 3: Configure sniffing [configuration] | COMMENT |
| LOW | …ce/packetbeat/packetbeat-installation-configuration.md | 372 | ## Step 4: Set up assets | COMMENT |
| LOW | …ce/packetbeat/packetbeat-installation-configuration.md | 432 | ## Step 5: Start Packetbeat | COMMENT |
| LOW | …ce/packetbeat/packetbeat-installation-configuration.md | 506 | ## Step 6: View your data in {{kib}} [view-data] | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 38 | // Step 1: Get the Elasticsearch Admin URL so we can query any index | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 41 | // Step 2: Format the search URL for the `foo` datastream | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 45 | // Step 3: Add query parameters | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 56 | // Step 4: Perform the HTTP GET request using HttpDo | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 63 | // Step 5: Parse the response body to extract events | COMMENT |
| LOW | libbeat/tests/integration/elasticsearch.go | 76 | // Step 6: Extract the `message` field from each event and return the messages | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials.go | 301 | // Step 2: Assume the remote role (the user's configured role), using the | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 108 | // Step 1: AssumeRoleWithWebIdentity → Elastic Global Role | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 127 | // Step 2: AssumeRole → customer remote role | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 204 | // Step 1: AssumeRole → Elastic Global Role (IRSA path, no WebIdentity) | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 223 | // Step 2: AssumeRole → customer remote role | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | metricbeat/module/elasticsearch/test_elasticsearch.py | 38 | except NotFoundError: | CODE |
| HIGH | metricbeat/module/elasticsearch/test_elasticsearch.py | 47 | except NotFoundError: | CODE |
| HIGH | metricbeat/module/elasticsearch/test_elasticsearch.py | 54 | except NotFoundError: | CODE |
| HIGH | filebeat/tests/system/filebeat.py | 174 | except ValueError: # log file was incomplete, ignore mid writes | CODE |
| HIGH | filebeat/tests/system/test_modules.py | 190 | except NotFoundError: | CODE |
| HIGH | filebeat/tests/system/test_pipeline.py | 49 | except NotFoundError: | CODE |
| HIGH | libbeat/tests/system/beat/beat.py | 162 | except BaseException: | CODE |
| HIGH | libbeat/tests/system/beat/beat.py | 167 | except BaseException: | CODE |
| HIGH | libbeat/tests/system/beat/beat.py | 416 | except BaseException: | CODE |
| HIGH | libbeat/tests/system/beat/beat.py | 488 | except IOError: | CODE |
| HIGH | libbeat/tests/system/beat/beat.py | 587 | except IOError: | CODE |
| HIGH | libbeat/tests/system/beat/beat.py | 557 | except FileNotFoundError as e: | CODE |
| HIGH | libbeat/scripts/generate_makefile_doc.py | 66 | except BaseException: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | metricbeat/metricbeat.reference.yml | 1253 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | metricbeat/mb/module/example_test.go | 123 | // for demonstration purposes. | COMMENT |
| MEDIUM | filebeat/filebeat.reference.yml | 425 | # you can use different inputs for various configurations. | COMMENT |
| MEDIUM | filebeat/filebeat.reference.yml | 1581 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | filebeat/filebeat.yml | 18 | # you can use different inputs for various configurations. | COMMENT |
| MEDIUM | auditbeat/auditbeat.reference.yml | 285 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | winlogbeat/winlogbeat.reference.yml | 161 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | heartbeat/heartbeat.reference.yml | 405 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | packetbeat/packetbeat.yml | 12 | # Select the network interface to sniff the data. On Linux, you can use the | COMMENT |
| MEDIUM | packetbeat/packetbeat.reference.yml | 762 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | x-pack/osquerybeat/osquerybeat.reference.yml | 366 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | x-pack/metricbeat/metricbeat.reference.yml | 1930 | # For example, you can use the following processors to keep the fields that | COMMENT |
| LOW | …module/aws/mtest/scripts/test_cloudwatch_metricset.yml | 2 | # Please make sure you have EC2 instances running with tags. Then replace aws.yml | COMMENT |
| MEDIUM | x-pack/filebeat/filebeat.reference.yml | 2125 | # you can use different inputs for various configurations. | COMMENT |
| MEDIUM | x-pack/filebeat/filebeat.reference.yml | 3530 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | x-pack/filebeat/filebeat.yml | 18 | # you can use different inputs for various configurations. | COMMENT |
| MEDIUM | x-pack/auditbeat/auditbeat.reference.yml | 349 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | x-pack/winlogbeat/winlogbeat.reference.yml | 163 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | x-pack/heartbeat/heartbeat.reference.yml | 405 | # For example, you can use the following processors to keep the fields that | COMMENT |
| MEDIUM | x-pack/packetbeat/packetbeat.yml | 12 | # Select the network interface to sniff the data. On Linux, you can use the | COMMENT |
| MEDIUM | x-pack/packetbeat/packetbeat.reference.yml | 762 | # For example, you can use the following processors to keep the fields that | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | metricbeat/module/windows/wmi/config.go | 107 | // while we want to leverage all filtering capabilities | COMMENT |
| MEDIUM | metricbeat/module/kubernetes/util/kubernetes.go | 749 | // A metaGen struct implements a MetaGen interface and is designed to utilize the necessary watchers to collect(Generate | COMMENT |
| MEDIUM | …ditbeat/module/file_integrity/fileinfo_windows_test.go | 63 | // TestGetObjectSecurityInfoRobustness tests the robust security info functionality | COMMENT |
| MEDIUM | auditbeat/module/file_integrity/kprobes/path_inotify.go | 56 | // https://lore.kernel.org/all/20210810151220.285179-5-amir73il@gmail.com/). Essentially this commit adds | COMMENT |
| MEDIUM | libbeat/publisher/queue/slabqueue/slabqueue_test.go | 975 | // the target as live events drain. A generous bound keeps this robust on | COMMENT |
| MEDIUM | …beat/processors/add_cloud_metadata/provider_aws_ec2.go | 158 | // getTags is a helper to extract EC2 tags. Internally it utilize multiple extraction methods. | COMMENT |
| MEDIUM | libbeat/outputs/elasticsearch/client_proxy_test.go | 133 | // This test is less robust than the others: when golang derives proxy settings | COMMENT |
| MEDIUM | x-pack/metricbeat/module/azure/monitor_service.go | 440 | // we leverage the modified response interval | COMMENT |
| MEDIUM | x-pack/metricbeat/module/azure/client_batch.go | 241 | // we leverage the modified response interval | COMMENT |
| MEDIUM | …k/metricbeat/module/azure/app_insights/service_test.go | 161 | // the assertion robust against minor format changes across azcore versions. | COMMENT |
| MEDIUM | x-pack/metricbeat/module/meraki/reporter.go | 47 | // we make use of the fact that all the dashboard API responses utilize | COMMENT |
| MEDIUM | x-pack/filebeat/filebeat.reference.yml | 860 | # set to leverage this functionality. | COMMENT |
| MEDIUM | x-pack/filebeat/filebeat.reference.yml | 865 | # set to leverage this functionality. | COMMENT |
| MEDIUM | x-pack/filebeat/input/streaming/websocket.go | 173 | // this allows seamless header creation in formHeader() for the initial connection | COMMENT |
| MEDIUM | x-pack/filebeat/input/cel/input.go | 1021 | // more robust, but there is no real consensus and the RFC is not | COMMENT |
| LOW | …/filebeat/module/cyberarkpas/audit/ingest/pipeline.yml | 413 | # ... this script can be updated to just create two output lists, one | COMMENT |
| MEDIUM | x-pack/filebeat/module/fortinet/_meta/config.yml | 17 | # set to leverage this functionality. | COMMENT |
| MEDIUM | x-pack/filebeat/module/fortinet/_meta/config.yml | 22 | # set to leverage this functionality. | COMMENT |
| MEDIUM | x-pack/winlogbeat/module/wintest/simulate_test.go | 133 | // a robust indicator that the event has passed through the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | metricbeat/tests/system/test_base.py | 0 | test that the template can be loaded with `setup --index-management` | STRING |
| HIGH | filebeat/tests/system/test_base.py | 0 | test that the template can be loaded with `setup --index-management` | STRING |
| HIGH | auditbeat/tests/system/test_base.py | 0 | test that the template can be loaded with `setup --index-management` | STRING |
| HIGH | heartbeat/tests/system/test_base.py | 0 | test that the template can be loaded with `setup --index-management` | STRING |
| HIGH | …cketbeat/tests/system/test_0021_pgsql_send_opetions.py | 0 | should not include request and response by default. | STRING |
| HIGH | packetbeat/tests/system/test_0020_mysql_send_options.py | 0 | should not include request and response by default. | STRING |
| HIGH | packetbeat/tests/system/test_0022_redis_send_options.py | 0 | should not include request and response by default. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | metricbeat/module/kubernetes/util/kubernetes.go | 483 | // of a single node(e.g. created by pod metricset). In that case, we need to check if we are trying to create a new w | COMMENT |
| LOW | metricbeat/module/kubernetes/event/event.go | 133 | // so we need to check if they are valid first | COMMENT |
| LOW | heartbeat/reload/list.go | 125 | updateList[hash] = config // We need to check if the runner takes updates | CODE |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 38 | // Step 1: Get the Elasticsearch Admin URL so we can query any index | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 41 | // Step 2: Format the search URL for the `foo` datastream | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 45 | // Step 3: Add query parameters | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 56 | // Step 4: Perform the HTTP GET request using HttpDo | COMMENT |
| LOW⚡ | libbeat/tests/integration/elasticsearch.go | 63 | // Step 5: Parse the response body to extract events | COMMENT |
| LOW | libbeat/tests/integration/elasticsearch.go | 76 | // Step 6: Extract the `message` field from each event and return the messages | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials.go | 301 | // Step 2: Assume the remote role (the user's configured role), using the | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 108 | // Step 1: AssumeRoleWithWebIdentity → Elastic Global Role | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 127 | // Step 2: AssumeRole → customer remote role | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 204 | // Step 1: AssumeRole → Elastic Global Role (IRSA path, no WebIdentity) | COMMENT |
| LOW | x-pack/libbeat/common/aws/credentials_test.go | 223 | // Step 2: AssumeRole → customer remote role | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ollstats/testing/mongodb/standalone/seed-standalone.sh | 34 | # Check if docker is available | COMMENT |
| LOW | metricbeat/module/kafka/_meta/run.sh | 7 | # Check if KAFKA_ADVERTISED_HOST is set | COMMENT |
| LOW | metricbeat/module/elasticsearch/test_elasticsearch.py | 176 | # Check if an ml job already exists | COMMENT |
| LOW | metricbeat/module/elasticsearch/test_elasticsearch.py | 310 | # Check if trial is already enabled | COMMENT |
| LOW | metricbeat/module/elasticsearch/test_elasticsearch.py | 324 | # Check if basic license is already enabled | COMMENT |
| LOW | script/config_collector.py | 36 | # Check if full config exists | STRING |
| LOW | script/config_collector.py | 51 | # Check if short config was disabled in fields.yml | STRING |
| LOW | script/test_apm.sh | 12 | # Check if a special branch env variable is set | COMMENT |
| LOW | script/stresstest.sh | 76 | # Check if the test regex matches any tests | COMMENT |
| LOW | heartbeat/heartbeat.yml | 25 | # Set enabled to true (or delete the following line) to enable this monitor | COMMENT |
| LOW | packetbeat/scripts/create_tcp_protocol.py | 64 | # Write file to new location | COMMENT |
| LOW | .buildkite/scripts/docker.sh | 30 | # Check if we're logged in to Docker Hub | COMMENT |
| LOW | x-pack/metricbeat/module/ibmmq/test_ibmmq.py | 36 | # Verify if processors are correctly setup. | COMMENT |
| LOW | x-pack/heartbeat/heartbeat.yml | 25 | # Set enabled to true (or delete the following line) to enable this monitor | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | metricbeat/module/system/test_system.py | 261 | CODE | |
| LOW | filebeat/module/auditd/log/ingest/gen-ecs-mappings.py | 36 | CODE | |
| LOW | filebeat/tests/system/test_shutdown.py | 142 | CODE | |
| LOW | filebeat/tests/system/filebeat.py | 153 | CODE | |
| LOW | filebeat/tests/system/test_modules.py | 493 | CODE | |
| LOW | filebeat/tests/system/test_modules.py | 388 | CODE | |
| LOW | script/renamed_fields.py | 28 | CODE | |
| LOW | script/kibana-migration.py | 23 | CODE | |
| LOW | script/kibana-migration.py | 42 | CODE | |
| LOW | script/kibana-migration.py | 64 | CODE | |
| LOW | heartbeat/tests/system/test_autodiscovery.py | 16 | CODE | |
| LOW | libbeat/tests/system/beat/compose.py | 76 | CODE | |
| LOW | libbeat/tests/system/beat/beat.py | 433 | CODE | |
| LOW | libbeat/tests/system/beat/beat.py | 514 | CODE | |
| LOW | libbeat/tests/system/beat/beat.py | 568 | CODE | |
| LOW | dev-tools/aggregate_coverage.py | 12 | CODE | |
| LOW | dev-tools/cmd/dashboards/export_5x_dashboards.py | 8 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | docs/reference/serverless/beats.md | 47 | api_key: "YOUR_API_KEY" | CODE |
| HIGH | docs/reference/_snippets/aws-privatelink-cloud-id.md | 7 | api_key: "YOUR_API_KEY" | CODE |
| HIGH | docs/reference/_snippets/serverless-connect.md | 6 | api_key: "YOUR_API_KEY" <1> | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …beat/processors/translate_ldap_attribute/ldap_other.go | 28 | // TODO: implement automatic authentication for other platforms using kerberos | COMMENT |
| LOW⚡ | …querybeat/ext/osquery-extension/pkg/filters/filters.go | 180 | // TODO: implement, conversion is not simple | COMMENT |
| LOW⚡ | …querybeat/ext/osquery-extension/pkg/filters/filters.go | 183 | // TODO: implement? possibly N/A, only works with full text search tables | COMMENT |
| LOW⚡ | …querybeat/ext/osquery-extension/pkg/filters/filters.go | 186 | // TODO: implement | COMMENT |
| LOW⚡ | …querybeat/ext/osquery-extension/pkg/filters/filters.go | 187 | return false // TODO: implement | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | heartbeat/tests/system/test_telemetry.py | 22 | CODE | |
| MEDIUM | heartbeat/tests/system/test_telemetry.py | 27 | CODE | |
| MEDIUM | heartbeat/tests/system/test_telemetry.py | 28 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | libbeat/tests/system/beat/beat.py | 220 | except Exception as ex: | CODE |
| MEDIUM | .buildkite/pipeline-scheduler.py | 62 | print(f"Error: [{e}] when downloading from [{uri}]") | STRING |
| LOW | x-pack/auditbeat/tests/system/test_system_socket.py | 159 | except Exception as e: | CODE |
| LOW | x-pack/auditbeat/tests/system/test_system_socket.py | 178 | except Exception: | CODE |
| LOW | x-pack/auditbeat/tests/system/test_system_socket.py | 186 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | metricbeat/module/uwsgi/test_uwsgi.py | 10 | logger = logging.getLogger(__name__) | CODE |