[Zscaler] Integration - Pipeline error when reqmethod is NA

[Androulakakis]

Hello,

The ingest pipeline of the Zscaler integration produces the error message -For input string: "NA"-
when the reqmethod is not present, propably beacause respcode is also "NA" and not a number.

Please add conditionals to the pipelines logic.

example log:
{"sourcetype" : "zscalernss-web", "event" :{"time":"Thu Feb 16 10:17:13 2023","login":"deleted@deleted.com","proto":"SSL","eurl":"outlook.office365.com","dhost":"outlook.office365.com","action":"Allowed","reason":"Allowed","appname":"Outlook (Office 365)","appclass":"Webmail","reqsize":"50332","respsize":"2486375","stime":"81000","ctime":"81000","urlclass":"Business Use","urlsupercat":"Internet Communication","urlcat":"Webmail","malwarecat":"None","malwareclass":"None","threatname":"None","riskscore":"0","fileType":"None","location":"deleted","dept":"deleted","cip":"0.0.0.0","sip":"0.0.0.0","src":"0.0.0.0","reqmethod":"NA","respcode":"NA","ua" :"Unknown","ereferer":"None","ruletype":"None","rulelabel":"None","contenttype":"Other","unscannabletype":"None","deviceowner":"deleted","devicehostname":"deleted","md5hash":"None"}

Kind regards.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

If NA is a normal value then the integration could be made to ignore the conversion to a number for http.response.status_code.

integrations/packages/zscaler_zia/data_stream/web/elasticsearch/ingest_pipeline/default.yml

Lines 142 to 152 in 53dab46

	- convert:
	field: json.respcode
	target_field: http.response.status_code
	type: long
	ignore_missing: true
	on_failure:
	- remove:
	field: json.respcode
	- append:
	field: error.message
	value: '{{{_ingest.on_failure_message}}}'

[ashaka-elastic]

@Androulakakis, we are looking into this issue.

[elasticmachine]

Package zscaler_zia - 2.7.1 containing this change is available at https://epr.elastic.co/search?package=zscaler_zia