Skip to content

[checkpoint] Ensure event.original is always set to message - #10645

Merged
taylor-swanson merged 2 commits into
elastic:mainfrom
taylor-swanson:bug/checkpoint-event-original
Jul 29, 2024
Merged

[checkpoint] Ensure event.original is always set to message#10645
taylor-swanson merged 2 commits into
elastic:mainfrom
taylor-swanson:bug/checkpoint-event-original

Conversation

@taylor-swanson

@taylor-swanson taylor-swanson commented Jul 29, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

  • Situations may arise where event.original is set to non-standard or incorrect value by some external source, such as Logstash. Since the value we need is the contents of the message field, the value of event.original will be set to the value of message in all cases.
  • Add remove processor to delete message field to mimic behavior of the old rename processor.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

cd packages/checkpoint
elastic-package test

Related issues

  • Relates elastic/sdh-beats#4977
@taylor-swanson
[checkpoint] Ensure event.original is always set to message
9baaf9f 
- Situations may arise where event.original is set to non-standard
or incorrect value by some external source, such as Logstash. Since
the value we need is the contents of the message field, the value of
event.original will be set to the value of message in all cases.
- Add remove processor to remove message field to mimic behavior of
rename processor.
@taylor-swanson taylor-swanson added bug Something isn't working, use only for issues Integration:checkpoint Check Point Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices] labels Jul 29, 2024
@taylor-swanson taylor-swanson self-assigned this Jul 29, 2024
@elasticmachine

elasticmachine commented Jul 29, 2024

Copy link
Copy Markdown

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elastic-sonarqube

elastic-sonarqube Bot commented Jul 29, 2024

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
58.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@elasticmachine

elasticmachine commented Jul 29, 2024

Copy link
Copy Markdown

💚 Build Succeeded

cc @taylor-swanson
@taylor-swanson
taylor-swanson marked this pull request as ready for review July 29, 2024 17:33
@taylor-swanson
taylor-swanson requested a review from a team as a code owner July 29, 2024 17:33
@elasticmachine

elasticmachine commented Jul 29, 2024

Copy link
Copy Markdown

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)
pkoutsovasilis
pkoutsovasilis approved these changes Jul 29, 2024
View reviewed changes

@pkoutsovasilis pkoutsovasilis left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it makes sense me to always set correctly the event.original from the original message and not only when this is not present thus LGTM
@taylor-swanson
taylor-swanson merged commit dad9345 into elastic:main Jul 29, 2024
@taylor-swanson
taylor-swanson deleted the bug/checkpoint-event-original branch July 29, 2024 17:47
@taylor-swanson

taylor-swanson commented Jul 29, 2024

Copy link
Copy Markdown
Contributor Author

it makes sense me to always set correctly the event.original from the original message and not only when this is not present thus LGTM

There's also this weird behavior where message can be left around if event.original was already set, which can potentially mess up rename processors down the line. I'm not sure if we've seen that exact issue come up, but it could in theory happen.
@elasticmachine

elasticmachine commented Jul 29, 2024

Copy link
Copy Markdown

Package checkpoint - 1.31.1 containing this change is available at https://epr.elastic.co/search?package=checkpoint
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 4, 2025
@taylor-swanson
[checkpoint] Ensure event.original is always set to message (elastic#…
a460bcf 
…10645)

- Situations may arise where event.original is set to non-standard
or incorrect value by some external source, such as Logstash. Since
the value we need is the contents of the message field, the value of
event.original will be set to the value of message in all cases.
- Add remove processor to remove message field to mimic behavior of
rename processor.
harnish-crest-data pushed a commit to chavdaharnish/integrations that referenced this pull request Feb 5, 2025
@taylor-swanson
[checkpoint] Ensure event.original is always set to message (elastic#…
39ebfda 
…10645)

- Situations may arise where event.original is set to non-standard
or incorrect value by some external source, such as Logstash. Since
the value we need is the contents of the message field, the value of
event.original will be set to the value of message in all cases.
- Add remove processor to remove message field to mimic behavior of
rename processor.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working, use only for issues Integration:checkpoint Check Point Team:Security-Deployment and Devices DEPRECATED Deployment and Devices Security team [elastic/sec-deployment-and-devices]

3 participants

@taylor-swanson @elasticmachine @pkoutsovasilis