New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[cisco_ios] Improve parsing groks to better handle generic messages #9102
[cisco_ios] Improve parsing groks to better handle generic messages #9102
Conversation
- The header of the log is now parsed first. A second grok runs afterwards which will look for the Cisco-mnemonic prefix for the message portion of log. If it is not found, the message will be placed into a temporary field until after Cisco messages have been processed, where it will then be placed back into the 'message' field. - Add hit count asserts to system tests - Add newlines to sample logs so last entries are not missed by logfile system test
on_failure: | ||
- append: | ||
field: error.message | ||
value: |- | ||
Processor "{{ _ingest.on_failure_processor_type }}" with tag "{{ _ingest.on_failure_processor_tag }}" in pipeline "{{ _ingest.on_failure_pipeline }}" failed with message "{{ _ingest.on_failure_message }}" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm pretty sure this is made redundant by the on_failure
handler for the pipeline.
🚀 Benchmarks reportTo see the full report comment with |
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
/test benchmark fullreport |
packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
💚 Build Succeeded
History
|
Quality Gate passedKudos, no new issues were introduced! 0 New issues |
Package cisco_ios - 1.26.1 containing this change is available at https://epr.elastic.co/search?package=cisco_ios |
…9102) - The header of the log is now parsed first. A second grok runs afterwards which will look for the Cisco-mnemonic prefix for the message portion of log. If it is not found, the message will be placed into a temporary field until after Cisco messages have been processed, where it will then be placed back into the 'message' field. - Add hit count asserts to system tests - Add newlines to sample logs so last entries are not missed by logfile system test
Proposed commit message
Checklist
changelog.yml
file.How to test this PR locally
Related issues