imperva_cloud_waf: step over non-UTF-8 data work items

packages/imperva_cloud_waf/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.11.0"
+  changes:
+    - description: Prevent stale compressed data wedging log collection.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/13152
 - version: "1.10.2"
   changes:
     - description: Clarify documentation regarding Imperva file compression configuration.

packages/imperva_cloud_waf/data_stream/event/agent/stream/cel.yml.hbs

@@ -72,7 +72,22 @@ program: |
         }
       }).do_request().as(resp, resp.StatusCode == 200 ?
         bytes(resp.Body).as(body, {
-          "events": (string(body)+"|==|").split("|==|")[1].split("\n").filter(x,x!="").map(x,{"message":x}),
+          "events": try(string(body), "error").as(body, type(body) == type("") ?
+          	(body+"|==|").split("|==|")[1].split("\n").filter(x,x!="").map(x,{"message":x})
+          :
+            // This is an unrecoverable error for the worklist element; it indicates
+            // most likely that the data was compressed, or was encrypted. We cannot
+            // handle this, so we step past it and log the failure. We are in an
+            // unfortunate position where ideally we would like this to cause a health
+            // status note in fleet to result, but we cannot do this since this would
+            // delete the cursor update and we would still be stuck here, so we just
+            // log into the index in the hope that someone will see it.
+            [{"error":
+              {
+                "message": v.worklist[v.next].filename + ": " + body.error + ": check imperva waf logging is configured correctly",
+              },
+            }]
+          ),
           "cursor": {
             "log_file": (
               has(state.cursor) && has(state.cursor.log_file) && state.cursor.log_file != null

packages/imperva_cloud_waf/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.0.3
 name: imperva_cloud_waf
 title: Imperva Cloud WAF
-version: "1.10.2"
+version: "1.11.0"
 description: Collect logs from Imperva Cloud WAF with Elastic Agent.
 type: integration
 categories: