Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[TCP/UDP] Add missing ECS syslog mapping #8870

Merged
merged 3 commits into from
Jan 12, 2024
Merged

[TCP/UDP] Add missing ECS syslog mapping #8870

merged 3 commits into from
Jan 12, 2024

Conversation

chemamartinez
Copy link
Contributor

@chemamartinez chemamartinez commented Jan 12, 2024 •
edited
Loading

Proposed commit message

It has been reported an error in the Custom UDP integration. Since log.syslog.structured_data is not defined in the ECS template, each subfield in this object is mapped and indexed separately potentially leading to a mapping explosion.

This PR adds the missing log.syslog.* ECS mappings to the ECS template in UDP and TCP integrations, so the content of log.syslog.structured_data is mapped as a single field.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

cd packages/tcp && elastic-package test
cd packages/udp && elastic-package test

@chemamartinez chemamartinez added Team:Security-External Integrations bugfix Pull request that fixes a bug issue Integration:tcp Custom TCP Logs Integration:udp Custom UDP Logs labels Jan 12, 2024
@chemamartinez chemamartinez self-assigned this Jan 12, 2024
@chemamartinez chemamartinez marked this pull request as ready for review January 12, 2024 10:24
@chemamartinez chemamartinez requested a review from a team as a code owner January 12, 2024 10:24
@elasticmachine
Copy link

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

taylor-swanson
taylor-swanson approved these changes Jan 12, 2024
View reviewed changes
Copy link
Contributor

@taylor-swanson taylor-swanson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@chemamartinez chemamartinez merged commit 69ceb82 into elastic:main Jan 12, 2024
3 checks passed
@elasticmachine
Copy link

Package tcp - 1.18.0 containing this change is available at https://epr.elastic.co/search?package=tcp

@elasticmachine
Copy link

Package udp - 1.18.0 containing this change is available at https://epr.elastic.co/search?package=udp

@narph narph added the Team:Security-Service Integrations Security Service Integrations Team [elastic/security-service-integrations] label Jun 13, 2024
@elasticmachine
Copy link

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@taylor-swanson taylor-swanson taylor-swanson approved these changes

Assignees

@chemamartinez chemamartinez

Labels
bugfix Pull request that fixes a bug issue Integration:tcp Custom TCP Logs Integration:udp Custom UDP Logs Team:Security-Service Integrations Security Service Integrations Team [elastic/security-service-integrations]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@chemamartinez @elasticmachine @taylor-swanson @narph