var categorizeEvent = function()

in x-pack/filebeat/module/google_workspace/drive/config/pipeline.js [9:53]


    var categorizeEvent = function(evt) {
        evt.Put("event.category", ["file"]);
        switch (evt.Get("event.action")) {
            case "add_to_folder":
            case "edit":
            case "add_lock":
            case "move":
            case "remove_from_folder":
            case "rename":
            case "remove_lock":
            case "sheets_import_range":
                evt.Put("event.type", ["change"]);
                break;
            case "approval_canceled":
            case "approval_comment_added":
            case "approval_requested":
            case "approval_reviewer_responded":
            case "change_acl_editors":
            case "change_document_access_scope":
            case "change_document_visibility":
            case "shared_drive_membership_change":
            case "shared_drive_settings_change":
            case "sheets_import_range_access_change":
            case "change_user_access":
                evt.AppendTo("event.category", "iam");
                evt.AppendTo("event.category", "configuration");
                evt.Put("event.type", ["change"]);
                break;
            case "create":
            case "untrash":
            case "upload":
                evt.Put("event.type", ["creation"]);
                break;
            case "delete":
            case "trash":
                evt.Put("event.type", ["deletion"]);
                break;
            case "download":
            case "preview":
            case "print":
            case "view":
                evt.Put("event.type", ["info"]);
                break;
        }
    };