Skip to content

[checkpoint] Update kv split for checkpoint - #15745

Merged
taylor-swanson merged 16 commits into
elastic:mainfrom
ash-darin:update-kv-split
Jan 5, 2026
Merged

[checkpoint] Update kv split for checkpoint#15745
taylor-swanson merged 16 commits into
elastic:mainfrom
ash-darin:update-kv-split

Conversation

@ash-darin

@ash-darin ash-darin commented Oct 24, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Enhancement

Proposed commit message

This uses a more complex Regex to split the KV pairs in the Checkpoint message.

This is necessary if you use it to process email, as the headers might contain strings of the form:

X-IronPort-AV: E=Sophos;i=\\\"8.18,219,1756234400\\\"; d=\\\"png

"; Sophos

The original regex would regeard both examples as a split, when in reality they are not. Use (negative) lookbehind to box the kv split parameter in.

(?<!\\")(?<="); (?=\w)

lookbehind: (?<=") react to ";
but
negative lookbehind: (?<!\\") do not react to \";

lookahead: (?=\w) expect a character after 1 (one) space: ; abcd

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.

How to test this PR locally

Check your logs/indices if any messages are rejected. Apply fix and check whether numbers go down..
@ash-darin
ash-darin requested a review from a team as a code owner October 24, 2025 09:21
@ash-darin ash-darin closed this Oct 24, 2025
@ash-darin ash-darin reopened this Oct 24, 2025
@ash-darin ash-darin changed the title Update kv split Oct 24, 2025
@ash-darin ash-darin changed the title Update kv split for checkpoint Oct 24, 2025
@andrewkroh andrewkroh added Integration:checkpoint Check Point Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Oct 24, 2025
@elasticmachine

elasticmachine commented Oct 24, 2025

Copy link
Copy Markdown

Pinging @elastic/integration-experience (Team:Integration-Experience)
taylor-swanson
taylor-swanson reviewed Oct 24, 2025
View reviewed changes

@taylor-swanson taylor-swanson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add a pipeline test to verify the change behaves correctly?

Additionally, the version in manifest.yml needs to be updated to match the changelog (1.41.3)
@ash-darin

ash-darin commented Nov 18, 2025

Copy link
Copy Markdown
Contributor Author

@taylor-swanson I updated the changelog and added a test case in a hopefully sufficient way, as I shortened it considerably. The original message with all the headers would have been 24kb.
@andrewkroh andrewkroh added the enhancement New feature or request label Nov 25, 2025
@taylor-swanson

taylor-swanson commented Jan 5, 2026

Copy link
Copy Markdown
Contributor

/test
@taylor-swanson

taylor-swanson commented Jan 5, 2026

Copy link
Copy Markdown
Contributor

/test
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jan 5, 2026

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented Jan 5, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History
taylor-swanson
taylor-swanson approved these changes Jan 5, 2026
View reviewed changes

@taylor-swanson taylor-swanson left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

As a note, I copied the new sample log from the system test over to the pipeline tests and added a couple of missing field mappings.
@taylor-swanson
taylor-swanson merged commit 3f0576a into elastic:main Jan 5, 2026
8 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Jan 5, 2026

Copy link
Copy Markdown
Contributor

Package checkpoint - 1.44.0 containing this change is available at https://epr.elastic.co/package/checkpoint/1.44.0/
@andrewkroh andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jan 8, 2026
@ash-darin
ash-darin deleted the update-kv-split branch January 9, 2026 14:21
jakubgalecki0 pushed a commit to jakubgalecki0/integrations that referenced this pull request Feb 19, 2026
@ash-darin @taylor-swanson @jakubgalecki0
[checkpoint] Update kv split for checkpoint (elastic#15745)
8076ca9 
- Improved the kv split for checkpoint messages to handle escaped characters.
- Added cases to system and pipeline tests.

---------

Co-authored-by: Taylor Swanson <taylor.swanson@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:checkpoint Check Point Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

4 participants

@ash-darin @elasticmachine @taylor-swanson @andrewkroh