Skip to content

[system] Use user.target.* in New users and groups dashboard #20352

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nicholasberlin merged 1 commit into from
Sep 15, 2026
+15 −9
Merged

[system] Use user.target.* in New users and groups dashboard #20352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions packages/system/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,10 @@
# later versions go on top
- version: "2.24.0"
changes:
- description: >-
Update the New users and groups dashboard to read the created account from `user.target.name`/`user.target.id` instead of the deprecated duplication in `user.name`/`user.id`. The New users panels only show events ingested with system 2.22.0 or later, where these fields were introduced.
type: enhancement
link: https://github.com/elastic/integrations/issues/20105
- version: "2.23.5"
changes:
- description: Populate `event.action` for Linux useradd/userdel/groupadd/groupdel auth events, extract `group.name` from gshadow/group file lines, and set `service.name` plus `event.action` for sudo systemctl start/stop/restart commands.
Expand Down
16 changes: 8 additions & 8 deletions packages/system/kibana/dashboard/system-0d3f2380-fa78-11e6-ae9b-81e5311e8cab.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -236,7 +236,7 @@
"size": 5
},
"scale": "ordinal",
"sourceField": "user.id"
"sourceField": "user.target.id"
},
"7b9368fd-c087-4f71-b9ca-454774a85c72": {
"customLabel": true,
Expand All @@ -262,7 +262,7 @@
"size": 5
},
"scale": "ordinal",
"sourceField": "user.name"
"sourceField": "user.target.name"
},
"db31a995-74d5-49ed-be8b-4e70cbf80ce4": {
"customLabel": true,
Expand Down Expand Up @@ -448,7 +448,7 @@
"customLabel": true,
"dataType": "string",
"isBucketed": true,
"label": "user.name: Descending",
"label": "user.target.name: Descending",
"operationType": "terms",
"params": {
"exclude": [],
Expand All @@ -468,7 +468,7 @@
"size": 5
},
"scale": "ordinal",
"sourceField": "user.name"
"sourceField": "user.target.name"
}
},
"ignoreGlobalFilters": false,
Expand Down Expand Up @@ -641,7 +641,7 @@
"customLabel": true,
"dataType": "string",
"isBucketed": true,
"label": "user.name: Descending",
"label": "user.target.name: Descending",
"operationType": "terms",
"params": {
"exclude": [],
Expand All @@ -661,7 +661,7 @@
"size": 5
},
"scale": "ordinal",
"sourceField": "user.name"
"sourceField": "user.target.name"
}
},
"ignoreGlobalFilters": false,
Expand Down Expand Up @@ -773,7 +773,7 @@
"customLabel": true,
"dataType": "string",
"isBucketed": true,
"label": "user.name: Descending",
"label": "user.target.name: Descending",
"operationType": "terms",
"params": {
"exclude": [],
Expand All @@ -793,7 +793,7 @@
"size": 5
},
"scale": "ordinal",
"sourceField": "user.name"
"sourceField": "user.target.name"
},
"87629456-e54e-47dc-854b-6eabac7052ec": {
"customLabel": true,
Expand Down
2 changes: 1 addition & 1 deletion packages/system/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 3.4.0
name: system
title: System
version: "2.23.5"
version: "2.24.0"
description: Collect system logs and metrics from your servers with Elastic Agent.
type: integration
categories:
Expand Down
Loading