elastic / elastic/integrations
[slack.audit] previous_ip_address convert fails with empty string
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
### Integration Name
Slack Logs [slack]
### Dataset Name
slack.audit
### Integration Version
1.25.1
### Agent Version
9.2.4
### Agent Output Type
logstash
### Elasticsearch Version
9.2.4
### OS Version and Architecture
ECH
### Software/API Version
_No response_
### Error Message
Processor 'convert' with tag '' failed with message ''' is not an IP string literal.'
### Event Original
```json
"actor":{
"type":"user",
"user":{
"email":"[redacted]",
"id":"[redacted]",
"name":"[redacted]",
"team":"[redacted]"
}
},
"context":{
"ip_address":"[redacted]",
"location":{
"domain":"[redacted]",
"id":"[redacted]",
"name":"[redacted]",
"type":"workspace"
},
"session_id":[redacted],
"ua":"[redacted]"
},
"date_create":1769009970,
"details":{
"action_timestamp":1769009966871903,
"location":"[redacted]",
"previous_ip_address":"",
"previous_ua":"",
"reason":["asn","ip_address"]
},
"entity":{
"type":"user",
"user":{
"email":"[redacted]",
"id":"[redacted]",
"name":"[redacted],
"team":"[redacted]"
}
},
"id":"[redacted]"
}
```
### What did you do?
OOTB
### What did you see?
A pipeline error on empty values
### What did you expect to see?
A check to remove the field if it's blank prior to the convert, so blank values never reach the convert and don't throw an error
### Anything else?
The [convert](https://github.com/elastic/integrations/blob/3c3df98b1bc4e4d026406e1d4be21e14e577de90/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml#L135) `previous_ip_address` to type `IP` is throwing this [error](https://github.com/elastic/integrations/blob/3c3df98b1bc4e4d026406e1d4be21e14e577de90/packages/slack/data_stream/audit/elasticsearch/ingest_pipeline/default.yml#L147C1-L152C110) similar to a [previous issue](https://github.com/elastic/integrations/issues/14821) with `source.address`
Per [#12083](https://github.com/elastic/seceng/issues/12083)
Contributor guide
Assessment
This issue has not been assessed yet.