From 02c56d602fa50db0d8ca2692b412a2ce58bb774a Mon Sep 17 00:00:00 2001
From: Eric <menwe@amazon.com>
Date: Wed, 8 Nov 2023 21:29:50 +0000
Subject: [PATCH] Revert "Correct query schema for ELB mview generation (#1196)
 (#1199)"

This reverts commit 0b7be956e56b317e17d70df6d1235d7a9ea1cafa.
---
 public/services/requests/sql.ts               |  1 +
 .../aws_elb/assets/create_mv-1.0.0.sql        | 79 +++++++++----------
 2 files changed, 39 insertions(+), 41 deletions(-)

diff --git a/public/services/requests/sql.ts b/public/services/requests/sql.ts
index 1ec3b3d2a9..b28323f033 100644
--- a/public/services/requests/sql.ts
+++ b/public/services/requests/sql.ts
@@ -6,6 +6,7 @@
 import { CoreStart } from '../../../../../src/core/public';
 import { DirectQueryRequest } from '../../../common/types/explorer';
 
+
 export class SQLService {
   private http;
   constructor(http: CoreStart['http']) {
diff --git a/server/adaptors/integrations/__data__/repository/aws_elb/assets/create_mv-1.0.0.sql b/server/adaptors/integrations/__data__/repository/aws_elb/assets/create_mv-1.0.0.sql
index ecb48c084e..8520ae8b73 100644
--- a/server/adaptors/integrations/__data__/repository/aws_elb/assets/create_mv-1.0.0.sql
+++ b/server/adaptors/integrations/__data__/repository/aws_elb/assets/create_mv-1.0.0.sql
@@ -1,41 +1,38 @@
-CREATE MATERIALIZED VIEW {table_name}_mview AS
-SELECT
-    type as `aws.elb.elb_type`,
-    time as `@timestamp`,
-    elb as `aws.elb.elb_name`,
-    split_part (client_ip, ':', 1) as `communication.source.ip`,
-    split_part (client_ip, ':', 2) as `communication.source.port`,
-    split_part (target_ip, ':', 1) as `communication.destination.ip`,
-    split_part (target_ip, ':', 2) as `communication.destination.port`,
-    request_processing_time as `aws.elb.request_processing_time`,
-    target_processing_time as `aws.elb.target_processing_time`,
-    response_processing_time as `aws.elb.response_processing_time`,
-    elb_status_code as `http.response.status_code`,
-    target_status_code as `aws.elb.target_status_code`,
-    received_bytes as `aws.elb.received_bytes`,
-    sent_bytes as `aws.elb.sent_bytes`,
-    split_part (request, ' ', 1) as `http.request.method`,
-    split_part (request, ' ', 2) as `url.full`,
-    parse_url (split_part (request, ' ', 2), 'HOST') as `url.domain`,
-    parse_url (split_part (request, ' ', 2), 'PATH') as `url.path`,
-    split_part (request, ' ', 3) as `url.schema`,
-    request AS `http.request.body.content`,
-    user_agent as `http.user_agent.original`,
-    user_agent as `http.user_agent.name`,
-    ssl_cipher as `aws.elb.ssl_cipher`,
-    ssl_protocol as `aws.elb.ssl_protocol`,
-    split_part (target_group_arn, ':', 4) as `cloud.region`,
-    split_part (target_group_arn, ':', 5) as `cloud.account.id`,
-    trace_id as `traceId`,
-    chosen_cert_arn as `aws.elb.chosen_cert_arn`,
-    matched_rule_priority as `aws.elb.matched_rule_priority`,
-    request_creation_time as `aws.elb.request_creation_time`,
-    actions_executed as `aws.elb.actions_executed`,
-    redirect_url as `aws.elb.redirect_url`,
-    lambda_error_reason as `aws.elb.lambda_error_reason`,
-    target_port_list as `aws.elb.target_port_list`,
-    target_status_code_list as `aws.elb.target_status_code_list`,
-    classification as `aws.elb.classification`,
-    classification_reason as `aws.elb.classification_reason`
-FROM
-    {table_name};
+CREATE MATERIALIZED VIEW
+  {table_name}_mview AS
+    SELECT
+        type as `aws.elb.elb_type`,
+        time as `@timestamp`,
+        elb as `aws.elb.elb_name`,
+        split_part(client_ip, ':', 1) as `aws.elb.client.ip`,
+        split_part(client_ip, ':', 2) as `aws.elb.client.port`,
+        split_part(target_ip, ':', 1) as `aws.elb.target.ip`,
+        split_part(target_ip, ':', 2) as `aws.elb.target.port`,
+        request_processing_time as `aws.elb.request_processing_time`,
+        target_processing_time as `aws.elb.target_processing_time`,
+        response_processing_time as `aws.elb.response_processing_time`,
+        elb_status_code as `aws.elb.elb_status_code`,
+        target_status_code as `aws.elb.target_status_code`,
+        received_bytes as `aws.elb.received_bytes`,
+        sent_bytes as `aws.elb.sent_bytes`,
+        split_part(request, ' ', 1) as `http.request.method`,
+        split_part(request, ' ', 2) as `url.full`,
+        split_part(request, ' ', 3) as `url.schema`,
+        user_agent as `http.user_agent.name`,
+        ssl_cipher as `aws.elb.ssl_cipher`,
+        ssl_protocol as `aws.elb.ssl_protocol`,
+        target_group_arn as `aws.elb.target_group_arn`,
+        trace_id as `traceId`,
+        domain_name as `url.domain`,
+        chosen_cert_arn as `aws.elb.chosen_cert_arn`,
+        matched_rule_priority as `aws.elb.matched_rule_priority`,
+        request_creation_time as `aws.elb.request_creation_time`,
+        actions_executed as `aws.elb.actions_executed`,
+        redirect_url as `aws.elb.redirect_url`,
+        lambda_error_reason as `aws.elb.lambda_error_reason`,
+        target_port_list as `aws.elb.target_port_list`,
+        target_status_code_list as `aws.elb.target_status_code_list`,
+        classification as `aws.elb.classification`,
+        classification_reason as `aws.elb.classification_reason`
+    FROM
+        {table_name};