Skip to content

[fortinet_fortigate] Generate processor tags and normalize error handler #15540

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Oct 28, 2025
Merged

[fortinet_fortigate] Generate processor tags and normalize error handler #15540

merged 2 commits into from
Oct 28, 2025

Conversation

@taylor-swanson
Copy link
Contributor

@taylor-swanson taylor-swanson commented Oct 3, 2025 •
edited
Loading

Proposed commit message

  • Generate tags for processors missing tags
  • Normalize the pipeline error handler

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
    - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

@taylor-swanson taylor-swanson self-assigned this Oct 3, 2025
@taylor-swanson taylor-swanson added enhancement New feature or request Integration:fortinet_fortigate Fortinet FortiGate Firewall Logs Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Oct 3, 2025
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Oct 3, 2025

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@taylor-swanson taylor-swanson marked this pull request as ready for review October 6, 2025 13:54
@taylor-swanson taylor-swanson requested a review from a team as a code owner October 6, 2025 13:54
@elasticmachine
Copy link

elasticmachine commented Oct 6, 2025

Pinging @elastic/integration-experience (Team:Integration-Experience)

haetamoudi
haetamoudi reviewed Oct 8, 2025
View reviewed changes
packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/default.yml
value: "{{{destination.nat.ip}}}"
if: ctx.destination?.nat?.ip != null
allow_duplicates: false
- append:
Copy link
Contributor

@haetamoudi haetamoudi Oct 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

out of curiosity, would this duplication set the field twice? can this trigger an error because of allow_duplicates: false?

Copy link
Contributor Author

@taylor-swanson taylor-swanson Oct 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, because allow_duplicates is false, it won't set it twice. As far as I know, it shouldn't show up as an error (but then again I don't know, as ignore_failure still yields an increase in the error count 🤷‍♂️)

The issue here is that the processor does have to actually check every element of related.ip, do a string comparison, and fail out when it finds the existing value in there already.

@taylor-swanson taylor-swanson marked this pull request as draft October 21, 2025 16:49
@taylor-swanson
[fortinet_fortigate] Generate processor tags and normalize error handler
381a7b5 
- Generate tags for processors missing tags
- Normalize the pipeline error handler
@taylor-swanson taylor-swanson force-pushed the enhance/tag-fortinet_fortigate branch from 606f678 to 381a7b5 Compare October 22, 2025 12:54
@taylor-swanson taylor-swanson marked this pull request as ready for review October 22, 2025 13:25
@elasticmachine
Copy link

elasticmachine commented Oct 28, 2025

💚 Build Succeeded

History

cc @taylor-swanson

@taylor-swanson taylor-swanson merged commit 115d6fb into elastic:main Oct 28, 2025
7 checks passed
@taylor-swanson taylor-swanson deleted the enhance/tag-fortinet_fortigate branch October 28, 2025 13:14
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Oct 28, 2025

Package fortinet_fortigate - 1.34.1 containing this change is available at https://epr.elastic.co/package/fortinet_fortigate/1.34.1/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@haetamoudi haetamoudi haetamoudi approved these changes

Assignees

@taylor-swanson taylor-swanson

Labels

enhancement New feature or request Integration:fortinet_fortigate Fortinet FortiGate Firewall Logs Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@taylor-swanson @elasticmachine @haetamoudi