elastic / elastic/beats

Allow filebeat Azure activitylogs, platformlogs and auditlogs to work with IPv6 addresses

Open
#34,277 1 comment 1 reaction 1 assignee Claimed by @zmoog View on GitHub
Team:Cloud-Monitoring
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

Currently the activitylogs, platformlogs and auditlogs filesets have an ingest pipeline which uses GROK patterns to parse the source.ip field, however this breaks for IPv6 addresses. (`[...]failed to parse field [source.ip] of type [ip] in document with id xxxxxxx. . Preview of field's value: '2001'[...]`).

We have implemented a workaround by adding `%{IPV6:source.ip}` to the grok patterns in the ingest pipelines for these filesets, which is a little bit hacky since we're modifying automatically loaded pipelines that change with every filebeat version.

We'd be happy to create a pull request for this so we can go back to just using the regular pipeline management, but I'm not sure if this would be considered an acceptable workaround to have upstreamed. Could you please advise if we should open a pull request for this or not?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.