elastic / elastic/integrations
[All]: Adding event.kind pipeline_error to more integrations
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
### Integration Name
All [all]
### Dataset Name
_No response_
### Integration Version
Latest
### Agent Version
8.17.6
### OS Version and Architecture
Redhat 8.10
### User Goal
My goal is to enhance the search for pipeline error, when using elastic integration. By creating one field value of on_failure in elasticsearch-ingest-pipelines.
### Existing Features
Not all integrations have this implemented and I like to make this more universal. So at this moment we need to search manually in all available field, if pipeline error has accorded. Instead I then can search on one field with one expected value, to get overview of pipeline error.
### What did you see?
As an example https://github.com/elastic/integrations/blob/main/packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml
The auditd integration has on line 2271 a on_failure section.
```
on_failure:
- append:
field: error.message
value: "failed extracting process arguments: {{{ _ingest.on_failure_message }}}"
```
On line 2331 you can find second on_failure section, that include extra step. The set of event.kind field with value pipeline_error.
```
on_failure:
- set:
field: event.kind
value: pipeline_error
- append:
field: error.message
```
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.