elastic / elastic/integrations

[Azure Frontdoor]: Azure Frontdoor Logs are missing the azure.subscription_id and azure.resource_id field

Open
#20,519 1 comment 0 reactions 1 assignee Claimed by @mohitjha-elastic View on GitHub
enhancement Integration:azure_frontdoor needs:triage Team:SDE-Crest Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Azure Frontdoor [packages/azure_frontdoor]

### Dataset Name

azure.frontdoor_*

### Integration Version

2.5.0

### Agent Version

9.4.4

### OS Version and Architecture

Ubuntu 20.04

### User Goal

The goal is to have a uniformed schema for Azure Logs. Especially the field azure.subscription_id iscrucial (in our case) to distinguish the data coming from different subscriptions and thus tenants.

As of now, the data is written in the field:
```json
"azure": {
"frontdoor": {
....
"resource_id": "/SUBSCRIPTIONS//RESOURCEGROUPS//PROVIDERS/MICROSOFT.CDN/PROFILES/",
"category": "FrontDoorHealthProbeLog"
}},
```

### Existing Features

Currently, the data is stored in azure.frontdoor.resource_id

### What did you see?

The workaround is to use a custom pipeline called logs-azure_frontdoor.integration@custom. Example logic:

```yaml
processors:
- set:
field: azure.resource_id
copy_from: azure.frontdoor.resource_id
ignore_failure: true
- grok:
field: azure.resource_id
patterns:
- >-
/SUBSCRIPTIONS/%{SUBID:azure.subscription_id}/RESOURCEGROUPS/%{GROUPID:azure.resource.group}/PROVIDERS/%{PROVIDERNAME:azure.resource.provider}/%{PROVIDERNAME:azure.resource.name}
pattern_definitions:
SUBID: >-
(\{){0,1}[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}(\}){0,1}
GROUPID: .+
PROVIDERNAME: .+
NAMESPACE: .+
RULE: .+
ignore_failure: true
```

### Anything else?

Related issues:
- https://github.com/elastic/integrations/issues/11172

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.