Package aws/s3-server-access Release Notes
Package aws/s3-server-access Release Notes Version 1.1.0
The old parser s3access-space-delimited is deprecated, and replaced by the new parser aws-s3serveraccess. While the old parser will remain available during a transition period, all future changes will only go into the new aws-s3serveraccess parser. We recommend switching to the newer parser as soon as possible, to make for the smoothest upgrade. The old s3access-space-delimited parser will be removed at some point in the future. In your data, the field #type contains the name of the parser, so any queries you may have that searches for this field need to accomodate this change.
Duplicated vendor fields dropped in new parserThe old s3access-space-delimited parser would duplicate certain fields, which the new aws-s3serveraccess parser will not. The fields which were previously duplicated, would be present both under the Vendor namespace (e.g. Vendor.srcIp), and as a field mapped to CPS (e.g. source.ip). If the value of two such fields is byte-for-byte the same, the new parser will no longer preserve the vendor-specific field, but only the CPS field. If the value of the two fields differ, both fields will be preserved. This means the following fields will no longer be present in the parsed data, when using the new parser:
Vendor.bytes_sent
Vendor.cipher_suite
Vendor.http_status
Vendor.operation
Vendor.referrer
Vendor.remote_ip
Vendor.request_id
Vendor.requester
Vendor.total_time
Package aws/s3-server-access Release Notes Version 1.0.2
Fixes the parser to no longer drop events which don't contain tls_version and request_uri fields
Package aws/s3-server-access Release Notes Version 1.0.1
Improves the field extraction and performance.
Bumps parser version to 1.0.1
Package aws/s3-server-access Release Notes Version 1.0.0
Adds new event.module and Cps.version fields
Removes the Product, related.ip and related.user fields
Sets following tags: Cps.version, Vendor, ecs.version, event.dataset, event.kind, event.module, event.outcome, observer.type
Improves the field extraction