Merge branch 'main' into salesforce-fix

Author: Linu-Elias

.buildkite/pipeline.schedule-daily.yml

@@ -34,7 +34,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.6-SNAPSHOT
+        STACK_VERSION: 8.19.7-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "true"
     depends_on:
       - step: "check"
@@ -48,7 +48,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.6-SNAPSHOT
+        STACK_VERSION: 8.19.7-SNAPSHOT
         STACK_LOGSDB_ENABLED: "true"
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:

.github/CODEOWNERS

@@ -205,6 +205,7 @@
 /packages/elastic_package_registry @elastic/ecosystem
 /packages/elastic_security @elastic/security-service-integrations
 /packages/elasticsearch @elastic/stack-monitoring
+/packages/aws_elb_otel @elastic/obs-infraobs-integrations
 /packages/endace @elastic/integration-experience @elastic/sec-linux-platform
 /packages/endace/data_stream/flow @elastic/sec-linux-platform
 /packages/endace/data_stream/log @elastic/integration-experience
@@ -430,6 +431,7 @@
 /packages/system/data_stream/load @elastic/obs-infraobs-integrations
 /packages/system/data_stream/memory @elastic/obs-infraobs-integrations
 /packages/system/data_stream/network @elastic/obs-infraobs-integrations
+/packages/system/data_stream/ntp @elastic/obs-infraobs-integrations
 /packages/system/data_stream/process @elastic/obs-infraobs-integrations
 /packages/system/data_stream/process_summary @elastic/obs-infraobs-integrations
 /packages/system/data_stream/security @elastic/sec-windows-platform

.github/ISSUE_TEMPLATE/integration_bug.yml

@@ -43,7 +43,9 @@ body:
         - Auth0 [auth0]
         - authentik [authentik]
         - AWS Cost and Usage Report (CUR 2.0) [aws_billing]
+        - AWS ELB OpenTelemetry Assets [aws_elb_otel]
         - AWS Fargate (for ECS clusters) [awsfargate]
+        - AWS VPC Flow Logs OpenTelemetry Assets [aws_vpcflow_otel]
         - AWS [aws]
         - Azure AI Foundry [azure_ai_foundry]
         - Azure App Service [azure_app_service]

.github/ISSUE_TEMPLATE/integration_feature_request.yml

@@ -43,7 +43,9 @@ body:
         - Auth0 [auth0]
         - authentik [authentik]
         - AWS Cost and Usage Report (CUR 2.0) [aws_billing]
+        - AWS ELB OpenTelemetry Assets [aws_elb_otel]
         - AWS Fargate (for ECS clusters) [awsfargate]
+        - AWS VPC Flow Logs OpenTelemetry Assets [aws_vpcflow_otel]
         - AWS [aws]
         - Azure AI Foundry [azure_ai_foundry]
         - Azure App Service [azure_app_service]

.github/workflows/bump-elastic-stack-version.yml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/checkout@v5
 
       - name: Install Updatecli in the runner
-        uses: updatecli/updatecli-action@57aa8966d4d775cb1420b90c270ba97a4b5abe47 #v2.93.0
+        uses: updatecli/updatecli-action@719e3592d124cbf826da704cbe557e1221dd4bba #v2.94.0
 
       - name: Select diff action
         if: ${{ github.event_name == 'pull_request' }}

packages/arista_ngfw/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.4.2"
+  changes:
+    - description: Generate processor tags and normalize error handler.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/15524
 - version: "1.4.1"
   changes:
     - description: Changed owners.

packages/arista_ngfw/data_stream/log/elasticsearch/ingest_pipeline/admin_login.yml

@@ -5,18 +5,22 @@ processors:
   ## Admin Login Events ##
   ########################
   - rename:
+      tag: rename_arista_reason_to_event_reason_07f5af7a
       field: arista.reason
       target_field: event.reason
       ignore_missing: true
   - rename:
+      tag: rename_arista_login_to_user_name_3b52aae3
       field: arista.login
       target_field: user.name
       ignore_missing: true
   - rename:
+      tag: rename_arista_clientAddress_to_source_ip_1f127b6f
       field: arista.clientAddress
       target_field: source.ip
       ignore_missing: true
   - script:
+      tag: script_cef61fad
       lang: painless
       params:
         "false":
@@ -53,11 +57,11 @@ processors:
         ctx.event.type = params.get((ctx.arista.succeeded).toString()).get('type').clone();
         ctx.event.provider = params.get((ctx.arista.succeeded).toString()).get('provider');
         ctx.arista.remove('succeeded');
-  
   ##############
   ## Clean Up ##
   ##############
   - remove:
+      tag: remove_0dd05595
       description: Remove Arista fields that are not necessary after parsing to ECS
       field:
         - arista.local
@@ -68,4 +72,8 @@ on_failure:
       value: pipeline_error
   - append:
       field: error.message
-      value: '{{{ _ingest.on_failure_message }}}'
+      value: >-
+        Processor '{{{ _ingest.on_failure_processor_type }}}'
+        {{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
+        {{/_ingest.on_failure_processor_tag}}in pipeline '{{{ _ingest.pipeline }}}'
+        failed with message '{{{ _ingest.on_failure_message }}}'