fix linked accounts

elastic · Apr 7, 2024 · 776170a · 776170a
1 parent e1d5be2
commit 776170a
Showing 1 changed file with 14 additions and 7 deletions.
diff --git a/x-pack/metricbeat/module/aws/billing/billing.go b/x-pack/metricbeat/module/aws/billing/billing.go
@@ -359,6 +359,13 @@ func (m *MetricSet) getCostGroupBy(svcCostExplorer *costexplorer.Client, groupBy
 					if index == 0 {
 						if groupByPrimaryType == costexplorertypes.GroupDefinitionTypeDimension {
 							_, _ = event.MetricSetFields.Put("group_by."+groupBy.primary, key)
+
+							if groupBy.primary == "LINKED_ACCOUNT" {
+								if name, ok := accounts[key]; ok {
+									_, _ = event.RootFields.Put("aws.linked_account.id", key)
+									_, _ = event.RootFields.Put("aws.linked_account.name", name)
+								}
+							}
 						}
 						if groupByPrimaryType == costexplorertypes.GroupDefinitionTypeTag {
 							// tag key value is separated by $
@@ -374,6 +381,13 @@ func (m *MetricSet) getCostGroupBy(svcCostExplorer *costexplorer.Client, groupBy
 					if index == 1 {
 						if groupBySecondaryType == costexplorertypes.GroupDefinitionTypeDimension {
 							_, _ = event.MetricSetFields.Put("group_by."+groupBy.secondary, key)
+
+							if groupBy.secondary == "LINKED_ACCOUNT" {
+								if name, ok := accounts[key]; ok {
+									_, _ = event.RootFields.Put("aws.linked_account.id", key)
+									_, _ = event.RootFields.Put("aws.linked_account.name", name)
+								}
+							}
 						}
 						if groupBySecondaryType == costexplorertypes.GroupDefinitionTypeTag {
 							// tag key value is separated by $
@@ -391,13 +405,6 @@ func (m *MetricSet) getCostGroupBy(svcCostExplorer *costexplorer.Client, groupBy
 						m.Logger().Errorf("unexpected additional index %d, with key %s, while process metrics", index, key)
 						continue
 					}
-
-					if groupBy.primary == "LINKED_ACCOUNT" || groupBy.secondary == "LINKED_ACCOUNT" {
-						if name, ok := accounts[key]; ok {
-							_, _ = event.RootFields.Put("aws.linked_account.id", key)
-							_, _ = event.RootFields.Put("aws.linked_account.name", name)
-						}
-					}
 				}
 
 				t, err := time.Parse(dateLayout, endDate)