f5_bigip: handle Bot Defense and DoS event with quoted device_product value

[efd6]

Proposed commit message

f5_bigip: handle Bot Defense and DoS event with quoted device_product value

Sometimes, this is quoted, so extend the pattern match for the pipeline
routing to handle that.

Note

🎁

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[haetamoudi]

Suggested change

	if: ctx.event.original.contains('device_product=ASM') || ctx.event.original.contains('device_product="ASM"')
	strip_brackets: true
	if: ctx.event.original.contains('device_product=ASM') || ctx.event.original.contains('device_product="ASM"')

To ensure device_product="ASM" is parsed as ASM (not "ASM" with literal quotes). It also matches the first KV processor's behavior

[github-actions]

TL;DR

f5_bigip CI is failing in pipeline tests after normalizing DoS kv parsing with strip_brackets: true. That change now strips quotes from device_product="ASM", but the expected pipeline fixture still asserts the old quoted value.

Remediation

• Update packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-dos-and-bot.log-expected.json for the quoted DoS sample to match normalized output ("ASM" -> ASM) in:
  • f5_bigip.log.device.product (currently at line 351)
  • observer.product (currently at line 412)
• Re-run the package check for f5_bigip (same Buildkite step: .buildkite/scripts/test_one_package.sh packages/f5_bigip origin/main 2e9f3dafda25696deea7378c855d4425c059eb7c).

Investigation details

Root Cause

The last PR commit (2e9f3dafda25696deea7378c855d4425c059eb7c) changed the DoS KV processor in packages/f5_bigip/data_stream/log/elasticsearch/ingest_pipeline/pipeline_bigip_bot_and_dos.yml:

• line 19: strip_brackets: true added
• line 20: condition expanded to include device_product="ASM"

With strip_brackets: true, the parsed value for quoted inputs is normalized to ASM (without embedded quotes). The fixture file still expects "ASM" for the quoted test record.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/42837
• Job/step: Check integrations f5_bigip
• Key log excerpt:
  • --- [f5_bigip] failed
  • 🚨 Error: The command exited with status 1
• Code evidence:
  • packages/f5_bigip/data_stream/log/elasticsearch/ingest_pipeline/pipeline_bigip_bot_and_dos.yml:19-20
  • packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-dos-and-bot.log-expected.json:351
  • packages/f5_bigip/data_stream/log/_dev/test/pipeline/test-pipeline-bigip-dos-and-bot.log-expected.json:412

Verification

• Not run in this environment: the repository Buildkite wrapper depends on CI env vars/tools (.buildkite/scripts/common.sh failed locally with YQ_VERSION: unbound variable).

Follow-up

If quote-preserving behavior is intentional, remove strip_brackets: true instead and keep fixture expectations unchanged.

Note

🔒 Integrity filter blocked 4 items

The following items were blocked because they don't meet the GitHub integrity level.

• #18890 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• f5_bigip: handle Bot Defense and DoS event with quoted device_product value #18890 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18890 search_pull_requests: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• f5_bigip: handle Bot Defense and DoS event with quoted device_product value #18890 issue_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d15d9b1

History

• 💔 Build #42837 failed 2e9f3da
• 💚 Build #42543 succeeded 28af5f9

cc @efd6

[elastic-vault-github-plugin-prod]

Package f5_bigip - 1.28.0 containing this change is available at https://epr.elastic.co/package/f5_bigip/1.28.0/