elastic / elastic/integrations

[All]: Adding event.kind pipeline_error to more integrations

Open
#14,205 2 comments 0 reactions 0 assignees View on GitHub
enhancement Integration:All mapping/pipeline issue needs:triage Stalled
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

All [all]

### Dataset Name

_No response_

### Integration Version

Latest

### Agent Version

8.17.6

### OS Version and Architecture

Redhat 8.10

### User Goal

My goal is to enhance the search for pipeline error, when using elastic integration. By creating one field value of on_failure in elasticsearch-ingest-pipelines.

### Existing Features

Not all integrations have this implemented and I like to make this more universal. So at this moment we need to search manually in all available field, if pipeline error has accorded. Instead I then can search on one field with one expected value, to get overview of pipeline error.

### What did you see?

As an example https://github.com/elastic/integrations/blob/main/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
The auditd integration has on line 2271 a on_failure section.

```
on_failure:
- append:
field: error.message
value: "failed extracting process arguments: {{{ _ingest.on_failure_message }}}"
```

On line 2331 you can find second on_failure section, that include extra step. The set of event.kind field with value pipeline_error.
```
on_failure:
- set:
field: event.kind
value: pipeline_error
- append:
field: error.message
```

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.