elastic / elastic/integrations

[slack.audit] previous_ip_address convert fails with empty string

Open
#17,029 1 comment 0 reactions 0 assignees View on GitHub
Integration:slack maintainer:Community Team:SDE-Crest Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

Slack Logs [slack]

### Dataset Name

slack.audit

### Integration Version

1.25.1

### Agent Version

9.2.4

### Agent Output Type

logstash

### Elasticsearch Version

9.2.4

### OS Version and Architecture

ECH

### Software/API Version

_No response_

### Error Message

Processor 'convert' with tag '' failed with message ''' is not an IP string literal.'

### Event Original

```json
"actor":{
"type":"user",
"user":{
"email":"[redacted]",
"id":"[redacted]",
"name":"[redacted]",
"team":"[redacted]"
}
},
"context":{
"ip_address":"[redacted]",
"location":{
"domain":"[redacted]",
"id":"[redacted]",
"name":"[redacted]",
"type":"workspace"
},
"session_id":[redacted],
"ua":"[redacted]"
},
"date_create":1769009970,
"details":{
"action_timestamp":1769009966871903,
"location":"[redacted]",
"previous_ip_address":"",
"previous_ua":"",
"reason":["asn","ip_address"]
},
"entity":{
"type":"user",
"user":{
"email":"[redacted]",
"id":"[redacted]",
"name":"[redacted],
"team":"[redacted]"
}
},
"id":"[redacted]"
}
```

### What did you do?

OOTB

### What did you see?

A pipeline error on empty values

### What did you expect to see?

A check to remove the field if it's blank prior to the convert, so blank values never reach the convert and don't throw an error

### Anything else?

The [convert](https://github.com/elastic/integrations/blob/3c3df98b1bc4e4d026406e1d4be21e14e577de90/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml#L135) `previous_ip_address` to type `IP` is throwing this [error](https://github.com/elastic/integrations/blob/3c3df98b1bc4e4d026406e1d4be21e14e577de90/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml#L147C1-L152C110) similar to a [previous issue](https://github.com/elastic/integrations/issues/14821) with `source.address`

Per [#12083](https://github.com/elastic/seceng/issues/12083)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.