elastic / elastic/integrations
ssi: rewrite HTTP JSON data streams that do not use a persisted cursor to CEL
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
A block on the revision of HTTP JSON-based integrations to use the CEL input is that under the current filebeat state store system, it is not possible to migrate the HTTP JSON stored cursor to be used by the CEL input. However, there are a number of HTTP JSON data streams that do not use a stored cursor, so these can be migrated to CEL without resolution of the state store issue, without any cursor state loss impact on users.
- [x] bitdefender #14787
- [ ] bitwarden.collection
- [ ] bitwarden.group
- [ ] bitwarden.member
- [ ] bitwarden.policy
- [x] cisa_kevs #14804
- [ ] cisco_duo.summary
- [ ] github.code_scanning
- [ ] github.dependabot
- [ ] github.issues
- [ ] github.secret_scanning
- [ ] google_scc.asset
- [ ] google_scc.source
- [ ] lastpass.detailed_shared_folder
- [ ] lastpass.user
- [ ] rapid7_insightvm.asset
- [ ] ti_maltiverse
Note that there may be other impacts on migration that should be investigated (for example if the integration makes use of the HTTP JSON rate limit mechanism which is not compatible with the CEL input's rate limiter).
Contributor guide
Assessment
This issue has not been assessed yet.