[Infoblox BloxOne DDI] Ingest Pipeline Errors on Empty IP Fields, and Blank Messages Ingested

[MakoWish]

Describe the Issue

I noticed every document being ingested into our environment had an error.message for attempting to convert a value of '' to IP. We are also getting a new document every time there are zero results returned, but since they are essentially empty responses, those should be dropped.

Screenshots

Sample Data

This is a raw event that will replicate the pipeline error:

{
  "add_edns_option_in_outgoing_query": false,
  "comment": "",
  "created_at": "2023-09-14T18:54:45.215640Z",
  "custom_root_ns": [],
  "custom_root_ns_enabled": false,
  "disabled": false,
  "dnssec_enable_validation": true,
  "dnssec_enabled": true,
  "dnssec_root_keys": [
    {
      "algorithm": 8,
      "protocol_zone": ".",
      "public_key": "loremip/LoremipsumdolorsitametconsecteturadipiscingelitA/liquamcongueenimsitametliberoauctorblanditNullaquisfeliseuligulamaximusblanditsitametacenimInconguedoloripsumetaliquetnisiacc/umsansedDonecvulp/utateorcivitaealiquamelementumSedconguedolormaurisatconsecteturl/igulainterdumegetVivamusmattisnislvelrutrumvariusodiojustocongueliberoetconsecte=",
      "sep": true,
      "zone": "."
    }
  ],
  "dnssec_trust_anchors": [],
  "dnssec_validate_expiry": true,
  "ecs_enabled": false,
  "ecs_forwarding": false,
  "ecs_prefix_v4": 24,
  "ecs_prefix_v6": 56,
  "ecs_zones": [],
  "edns_udp_size": 1232,
  "filter_aaaa_acl": [],
  "filter_aaaa_on_v4": "no",
  "forwarders": [],
  "forwarders_only": false,
  "gss_tsig_enabled": false,
  "id": "dns/view/01234567-89ab-cdef-fedc-ba9876543210",
  "inheritance_sources": null,
  "ip_spaces": [],
  "lame_ttl": 600,
  "match_clients_acl": [
    {
      "access": "allow",
      "acl": null,
      "address": "",
      "element": "any",
      "tsig_key": null
    }
  ],
  "match_destinations_acl": [
    {
      "access": "allow",
      "acl": null,
      "address": "",
      "element": "any",
      "tsig_key": null
    }
  ],
  "match_recursive_only": false,
  "max_cache_ttl": 604800,
  "max_negative_ttl": 10800,
  "max_udp_size": 1232,
  "minimal_responses": false,
  "name": "default-Contoso",
  "notify": false,
  "query_acl": [],
  "recursion_acl": [],
  "recursion_enabled": false,
  "sort_list": [],
  "synthesize_address_records_from_https": false,
  "tags": {
    "nios/grid_name": "Contoso",
    "nios/imported": "true"
  },
  "transfer_acl": [],
  "update_acl": [],
  "updated_at": "2023-09-14T18:54:45.215640Z",
  "use_forwarders_for_subzones": true,
  "use_root_forwarders_for_local_resolution_with_b1td": false,
  "zone_authority": {
    "default_ttl": 28800,
    "expire": 2419200,
    "mname": "ns.foo",
    "negative_ttl": 900,
    "protocol_mname": "ns.foo",
    "protocol_rname": "admin",
    "refresh": 10800,
    "retry": 3600,
    "rname": "admin",
    "use_default_mname": true
  }
}

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[MakoWish]

I accidentally deleted my branch for this, so the PR closed itself. :-( I will resubmit tomorrow.