Allow filebeat Azure activitylogs, platformlogs and auditlogs to work with IPv6 addresses
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
Currently the activitylogs, platformlogs and auditlogs filesets have an ingest pipeline which uses GROK patterns to parse the source.ip field, however this breaks for IPv6 addresses. (`[...]failed to parse field [source.ip] of type [ip] in document with id xxxxxxx. . Preview of field's value: '2001'[...]`).
We have implemented a workaround by adding `%{IPV6:source.ip}` to the grok patterns in the ingest pipelines for these filesets, which is a little bit hacky since we're modifying automatically loaded pipelines that change with every filebeat version.
We'd be happy to create a pull request for this so we can go back to just using the regular pipeline management, but I'm not sure if this would be considered an acceptable workaround to have upstreamed. Could you please advise if we should open a pull request for this or not?
Contributor guide
Assessment
This issue has not been assessed yet.