Skip to content

feat: Preserve event.original when pipeline errors in integration-experience integrations (part 1) - #15798

Merged
taylor-swanson merged 2 commits into
elastic:mainfrom
taylor-swanson:chore/event-original-part1
Nov 6, 2025
Merged

feat: Preserve event.original when pipeline errors in integration-experience integrations (part 1)#15798
taylor-swanson merged 2 commits into
elastic:mainfrom
taylor-swanson:chore/event-original-part1

Conversation

@taylor-swanson

@taylor-swanson taylor-swanson commented Oct 29, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

  • Add append processor to pipeline on_failure handlers to preserve event.original.
  • Add append processor to pipeline to preserve event.original if error.message is set.

Integrations

  • arista_ngfw
  • cef
  • checkpoint
  • cisco_aironet
  • cisco_asa
  • cisco_ftd
  • cisco_ios
  • cisco_ise
  • cisco_nexus
  • cisco_secure_email_gateway

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
    - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues
@taylor-swanson taylor-swanson self-assigned this Oct 29, 2025
@taylor-swanson taylor-swanson added enhancement New feature or request Integration:cef Common Event Format (CEF) Integration:checkpoint Check Point Integration:cisco_ise Cisco ISE Integration:cisco_nexus Cisco Nexus Integration:cisco_ios Cisco IOS Integration:cisco_ftd Cisco FTD Integration:cisco_asa Cisco ASA Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Integration:cisco_aironet Cisco Aironet (Community supported) Integration:arista_ngfw Arista NG Firewall (Community supported) Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Oct 29, 2025
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Oct 29, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

Package cisco_aironet 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
log 2652.52 1992.03 -660.49 (-24.9%) 💔

Package cisco_asa 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
log 1156.07 773.4 -382.67 (-33.1%) 💔

Package cisco_ftd 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
log 1025.64 744.6 -281.04 (-27.4%) 💔

To see the full report comment with /test benchmark fullreport
@taylor-swanson
taylor-swanson force-pushed the chore/event-original-part1 branch from 76ace3f to 019cb0b Compare October 29, 2025 17:22
@taylor-swanson taylor-swanson added Integration:cisco_asa Cisco ASA Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Integration:cisco_aironet Cisco Aironet (Community supported) labels Oct 29, 2025
@taylor-swanson
feat: Preserve event.original when errors occur in pipelines
f5da8c3 
- Added append processor to global on_failure to preserve event original
- Added append processor to default pipelines to preserve event original if error.message is set

Affects the following integrations:

- arista_ngfw
- cef
- checkpoint
- cisco_aironet
- cisco_asa
- cisco_ftd
- cisco_ios
- cisco_ise
- cisco_nexus
- cisco_secure_email_gateway
@taylor-swanson
taylor-swanson force-pushed the chore/event-original-part1 branch from 019cb0b to f5da8c3 Compare October 29, 2025 17:53
@taylor-swanson
taylor-swanson marked this pull request as ready for review November 4, 2025 20:24
@taylor-swanson
taylor-swanson requested a review from a team as a code owner November 4, 2025 20:24
@elasticmachine

elasticmachine commented Nov 4, 2025

Copy link
Copy Markdown

Pinging @elastic/integration-experience (Team:Integration-Experience)
@taylor-swanson
taylor-swanson enabled auto-merge (squash) November 6, 2025 17:09
@taylor-swanson
taylor-swanson merged commit 47073ed into elastic:main Nov 6, 2025
7 checks passed
@elasticmachine

elasticmachine commented Nov 6, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @taylor-swanson
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package arista_ngfw - 1.5.0 containing this change is available at https://epr.elastic.co/package/arista_ngfw/1.5.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cef - 2.22.0 containing this change is available at https://epr.elastic.co/package/cef/2.22.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package checkpoint - 1.42.0 containing this change is available at https://epr.elastic.co/package/checkpoint/1.42.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cisco_aironet - 1.18.0 containing this change is available at https://epr.elastic.co/package/cisco_aironet/1.18.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cisco_asa - 2.44.0 containing this change is available at https://epr.elastic.co/package/cisco_asa/2.44.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cisco_ftd - 3.12.0 containing this change is available at https://epr.elastic.co/package/cisco_ftd/3.12.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cisco_ios - 1.34.0 containing this change is available at https://epr.elastic.co/package/cisco_ios/1.34.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cisco_ise - 1.30.0 containing this change is available at https://epr.elastic.co/package/cisco_ise/1.30.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cisco_nexus - 1.5.0 containing this change is available at https://epr.elastic.co/package/cisco_nexus/1.5.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cisco_secure_email_gateway - 1.28.0 containing this change is available at https://epr.elastic.co/package/cisco_secure_email_gateway/1.28.0/
@taylor-swanson
taylor-swanson deleted the chore/event-original-part1 branch November 6, 2025 19:21
tehbooom pushed a commit to tehbooom/integrations that referenced this pull request Nov 19, 2025
@taylor-swanson
feat: Preserve event.original when errors occur in pipelines (elastic…
ace2299 
…#15798)

- Added append processor to global on_failure to preserve event original
- Added append processor to default pipelines to preserve event original if error.message is set

Affects the following integrations:

- arista_ngfw
- cef
- checkpoint
- cisco_aironet
- cisco_asa
- cisco_ftd
- cisco_ios
- cisco_ise
- cisco_nexus
- cisco_secure_email_gateway
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:arista_ngfw Arista NG Firewall (Community supported) Integration:cef Common Event Format (CEF) Integration:checkpoint Check Point Integration:cisco_aironet Cisco Aironet (Community supported) Integration:cisco_asa Cisco ASA Integration:cisco_ftd Cisco FTD Integration:cisco_ios Cisco IOS Integration:cisco_ise Cisco ISE Integration:cisco_nexus Cisco Nexus Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

4 participants

@taylor-swanson @elasticmachine @haetamoudi @andrewkroh