Skip to content

Commit b4e850e

Browse files
taylor-swansontaylor-swanson
committed
[citrix_adc] Generate processor tags and normalize error handler
- Generate tags for processors missing tags - Normalize the pipeline error handler
1 parent 532c964 commit b4e850e

File tree

16 files changed

+248
-37
lines changed

16 files changed

+248
-37
lines changed

‎packages/citrix_adc/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "1.17.4"
3+
changes:
4+
- description: Generate processor tags and normalize error handler.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/15535
27
- version: "1.17.3"
38
changes:
49
- description: "Add support for additional log format patterns in sslvpn_clisec"

‎packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/alg_feature.yml‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
description: Pipeline for Citrix Native messages of ALG feature.
2+
description: Pipeline for Citrix Native messages of ALG feature.
33
processors:
44
- grok:
55
description: Extract fields from message of ALG feature.
@@ -21,6 +21,7 @@ processors:
2121
if: ctx.citrix_adc?.log?.destination?.ip != null && ctx.citrix_adc.log.destination.ip != ''
2222
on_failure:
2323
- append:
24+
tag: append_error_message_64d71fc8
2425
field: error.message
2526
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
2627
- set:
@@ -36,6 +37,7 @@ processors:
3637
if: ctx.citrix_adc?.log?.natted?.ip != null && ctx.citrix_adc.log.natted.ip != ''
3738
on_failure:
3839
- append:
40+
tag: append_error_message_cd6327c2
3941
field: error.message
4042
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
4143
- set:
@@ -50,6 +52,7 @@ processors:
5052
ignore_missing: true
5153
on_failure:
5254
- append:
55+
tag: append_error_message_63689943
5356
field: error.message
5457
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
5558
- set:
@@ -64,6 +67,7 @@ processors:
6467
ignore_missing: true
6568
on_failure:
6669
- append:
70+
tag: append_error_message_2f2ef7d3
6771
field: error.message
6872
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
6973
- set:
@@ -88,6 +92,7 @@ processors:
8892
ignore_missing: true
8993
on_failure:
9094
- append:
95+
tag: append_error_message_4220ffd0
9196
field: error.message
9297
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
9398
- set:
@@ -128,6 +133,7 @@ processors:
128133
if: ctx.citrix_adc?.log?.source?.ip != null && ctx.citrix_adc.log.source.ip != ''
129134
on_failure:
130135
- append:
136+
tag: append_error_message_5cfe9f0e
131137
field: error.message
132138
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
133139
- set:
@@ -142,6 +148,7 @@ processors:
142148
ignore_missing: true
143149
on_failure:
144150
- append:
151+
tag: append_error_message_7bbfad17
145152
field: error.message
146153
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
147154
- set:
@@ -166,6 +173,7 @@ processors:
166173
ignore_missing: true
167174
on_failure:
168175
- append:
176+
tag: append_error_message_57291f76
169177
field: error.message
170178
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
171179
- convert:
@@ -175,6 +183,7 @@ processors:
175183
ignore_missing: true
176184
on_failure:
177185
- append:
186+
tag: append_error_message_01ca5790
178187
field: error.message
179188
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
180189
on_failure:
@@ -183,5 +192,8 @@ on_failure:
183192
value: pipeline_error
184193
- append:
185194
field: error.message
186-
value: |-
187-
Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}"
195+
value: >-
196+
Processor '{{{ _ingest.on_failure_processor_type }}}'
197+
{{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
198+
{{/_ingest.on_failure_processor_tag}}in pipeline '{{{ _ingest.pipeline }}}'
199+
failed with message '{{{ _ingest.on_failure_message }}}'

‎packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/appfw_feature.yml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ processors:
4040
ignore_missing: true
4141
on_failure:
4242
- append:
43+
tag: append_error_message_d523a6fe
4344
field: error.message
4445
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
4546
- set:
@@ -59,6 +60,7 @@ processors:
5960
ignore_missing: true
6061
on_failure:
6162
- append:
63+
tag: append_error_message_0da74670
6264
field: error.message
6365
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
6466
- convert:
@@ -68,6 +70,7 @@ processors:
6870
ignore_missing: true
6971
on_failure:
7072
- append:
73+
tag: append_error_message_6745e0fc
7174
field: error.message
7275
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
7376
- convert:
@@ -77,6 +80,7 @@ processors:
7780
ignore_missing: true
7881
on_failure:
7982
- append:
83+
tag: append_error_message_38441d00
8084
field: error.message
8185
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
8286
- convert:
@@ -86,6 +90,7 @@ processors:
8690
ignore_missing: true
8791
on_failure:
8892
- append:
93+
tag: append_error_message_3fb880ab
8994
field: error.message
9095
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
9196
- convert:
@@ -95,6 +100,7 @@ processors:
95100
ignore_missing: true
96101
on_failure:
97102
- append:
103+
tag: append_error_message_1fe3e086
98104
field: error.message
99105
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
100106
- convert:
@@ -104,6 +110,7 @@ processors:
104110
ignore_missing: true
105111
on_failure:
106112
- append:
113+
tag: append_error_message_24909ef5
107114
field: error.message
108115
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
109116
- convert:
@@ -113,6 +120,7 @@ processors:
113120
ignore_missing: true
114121
on_failure:
115122
- append:
123+
tag: append_error_message_d4f1affa
116124
field: error.message
117125
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
118126
- convert:
@@ -122,6 +130,7 @@ processors:
122130
ignore_missing: true
123131
on_failure:
124132
- append:
133+
tag: append_error_message_de2f3c8d
125134
field: error.message
126135
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
127136
- convert:
@@ -131,6 +140,7 @@ processors:
131140
ignore_missing: true
132141
on_failure:
133142
- append:
143+
tag: append_error_message_126e11f6
134144
field: error.message
135145
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
136146
- convert:
@@ -140,6 +150,7 @@ processors:
140150
ignore_missing: true
141151
on_failure:
142152
- append:
153+
tag: append_error_message_9def762d
143154
field: error.message
144155
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
145156
- convert:
@@ -149,6 +160,7 @@ processors:
149160
ignore_missing: true
150161
on_failure:
151162
- append:
163+
tag: append_error_message_e5d2bbec
152164
field: error.message
153165
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
154166
- convert:
@@ -158,6 +170,7 @@ processors:
158170
ignore_missing: true
159171
on_failure:
160172
- append:
173+
tag: append_error_message_78e78597
161174
field: error.message
162175
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
163176
- convert:
@@ -167,6 +180,7 @@ processors:
167180
ignore_missing: true
168181
on_failure:
169182
- append:
183+
tag: append_error_message_8a0c76fc
170184
field: error.message
171185
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
172186
on_failure:
@@ -175,5 +189,8 @@ on_failure:
175189
value: pipeline_error
176190
- append:
177191
field: error.message
178-
value: |-
179-
Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}"
192+
value: >-
193+
Processor '{{{ _ingest.on_failure_processor_type }}}'
194+
{{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
195+
{{/_ingest.on_failure_processor_tag}}in pipeline '{{{ _ingest.pipeline }}}'
196+
failed with message '{{{ _ingest.on_failure_message }}}'

‎packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/bot_feature.yml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ processors:
1616
ignore_missing: true
1717
on_failure:
1818
- append:
19+
tag: append_error_message_94c6ac32
1920
field: error.message
2021
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
2122
- convert:
@@ -25,6 +26,7 @@ processors:
2526
ignore_missing: true
2627
on_failure:
2728
- append:
29+
tag: append_error_message_eb1ac20e
2830
field: error.message
2931
value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}'
3032
on_failure:
@@ -33,5 +35,8 @@ on_failure:
3335
value: pipeline_error
3436
- append:
3537
field: error.message
36-
value: |-
37-
Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}"
38+
value: >-
39+
Processor '{{{ _ingest.on_failure_processor_type }}}'
40+
{{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
41+
{{/_ingest.on_failure_processor_tag}}in pipeline '{{{ _ingest.pipeline }}}'
42+
failed with message '{{{ _ingest.on_failure_message }}}'

‎packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/cef.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ processors:
2121
field: citrix.extended
2222
tag: remove_extended
2323
if: ctx.citrix?.extended_kv != null
24-
24+
2525
# https://docs.citrix.com/en-us/citrix-adc/current-release/application-firewall/logs.html#common-event-format-cef-logs
2626
- convert:
2727
# src – source IP address
@@ -117,7 +117,7 @@ processors:
117117
tag: rename_extended_kv_cs6
118118
target_field: citrix.signature_violation_category
119119
ignore_missing: true
120-
120+
121121
- rename:
122122
field: citrix.extended_kv
123123
tag: rename_extended_kv
@@ -127,9 +127,11 @@ processors:
127127
on_failure:
128128
- append:
129129
field: error.message
130-
value: |-
131-
Processor "{{{ _ingest.on_failure_processor_type }}}" with tag "{{{ _ingest.on_failure_processor_tag }}}" in pipeline "{{{ _ingest.on_failure_pipeline }}}" failed with message "{{{ _ingest.on_failure_message }}}"
130+
value: >-
131+
Processor '{{{ _ingest.on_failure_processor_type }}}'
132+
{{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
133+
{{/_ingest.on_failure_processor_tag}}in pipeline '{{{ _ingest.pipeline }}}'
134+
failed with message '{{{ _ingest.on_failure_message }}}'
132135
- set:
133136
field: event.kind
134-
tag: set_pipeline_error_to_event_kind
135137
value: pipeline_error

0 commit comments

Comments
 (0)