From d3aec31797d0d6d149b4b89f51e5c7c551b6293f Mon Sep 17 00:00:00 2001 From: Nicholas Berlin Date: Fri, 24 Jul 2026 13:25:46 -0400 Subject: [PATCH] [system] Use user.target.* in New users and groups dashboard Updates the "[Logs System] New users and groups" dashboard to read the created account from user.target.name/user.target.id instead of user.name/user.id in the four New users panels (table, over time, by shell, by home directory). The New groups panels are unchanged, as groupadd events still map group.name/group.id. Since system 2.22.0 (elastic/integrations#20339) useradd events populate user.target.* with the created account; user.name/user.id only carry a deprecated duplication that a future major version will remove (contract phase of the expand-and-contract migration, elastic/integrations#20105). Moving the dashboard to the new fields now means it keeps working after that removal. Note the New users panels only show events ingested with system 2.22.0 or later, where user.target.* was introduced for useradd events. --- packages/system/changelog.yml | 6 ++++++ ...tem-0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json | 16 ++++++++-------- packages/system/manifest.yml | 2 +- 3 files changed, 15 insertions(+), 9 deletions(-) diff --git a/packages/system/changelog.yml b/packages/system/changelog.yml index 7a00e9762f2..09ac5d0eb3e 100644 --- a/packages/system/changelog.yml +++ b/packages/system/changelog.yml @@ -1,4 +1,10 @@ # later versions go on top +- version: "2.24.0" + changes: + - description: >- + Update the New users and groups dashboard to read the created account from `user.target.name`/`user.target.id` instead of the deprecated duplication in `user.name`/`user.id`. The New users panels only show events ingested with system 2.22.0 or later, where these fields were introduced. + type: enhancement + link: https://github.com/elastic/integrations/issues/20105 - version: "2.23.5" changes: - description: Populate `event.action` for Linux useradd/userdel/groupadd/groupdel auth events, extract `group.name` from gshadow/group file lines, and set `service.name` plus `event.action` for sudo systemctl start/stop/restart commands. diff --git a/packages/system/kibana/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json b/packages/system/kibana/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json index b5dcabc1488..383e34c9979 100644 --- a/packages/system/kibana/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json +++ b/packages/system/kibana/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json @@ -236,7 +236,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "user.id" + "sourceField": "user.target.id" }, "7b9368fd-c087-4f71-b9ca-454774a85c72": { "customLabel": true, @@ -262,7 +262,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "user.name" + "sourceField": "user.target.name" }, "db31a995-74d5-49ed-be8b-4e70cbf80ce4": { "customLabel": true, @@ -448,7 +448,7 @@ "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "user.name: Descending", + "label": "user.target.name: Descending", "operationType": "terms", "params": { "exclude": [], @@ -468,7 +468,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "user.name" + "sourceField": "user.target.name" } }, "ignoreGlobalFilters": false, @@ -641,7 +641,7 @@ "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "user.name: Descending", + "label": "user.target.name: Descending", "operationType": "terms", "params": { "exclude": [], @@ -661,7 +661,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "user.name" + "sourceField": "user.target.name" } }, "ignoreGlobalFilters": false, @@ -773,7 +773,7 @@ "customLabel": true, "dataType": "string", "isBucketed": true, - "label": "user.name: Descending", + "label": "user.target.name: Descending", "operationType": "terms", "params": { "exclude": [], @@ -793,7 +793,7 @@ "size": 5 }, "scale": "ordinal", - "sourceField": "user.name" + "sourceField": "user.target.name" }, "87629456-e54e-47dc-854b-6eabac7052ec": { "customLabel": true, diff --git a/packages/system/manifest.yml b/packages/system/manifest.yml index 56222b490d4..b57889d1201 100644 --- a/packages/system/manifest.yml +++ b/packages/system/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.4.0 name: system title: System -version: "2.23.5" +version: "2.24.0" description: Collect system logs and metrics from your servers with Elastic Agent. type: integration categories: