Skip to content

feat: Preserve event.original when pipeline errors in integration-experience integrations (part 4) - #15806

Merged
taylor-swanson merged 1 commit into
elastic:mainfrom
taylor-swanson:chore/event-original-part4
Nov 6, 2025
Merged

feat: Preserve event.original when pipeline errors in integration-experience integrations (part 4)#15806
taylor-swanson merged 1 commit into
elastic:mainfrom
taylor-swanson:chore/event-original-part4

Conversation

@taylor-swanson

@taylor-swanson taylor-swanson commented Oct 29, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Proposed commit message

  • Add append processor to pipeline on_failure handlers to preserve event.original.
  • Add append processor to pipeline to preserve event.original if error.message is set.

Integrations

  • sophos
  • squid
  • stormshield
  • suricata
  • syslog_router
  • tetragon
  • watchguard_firebox
  • zeek

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
    - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues
@taylor-swanson taylor-swanson self-assigned this Oct 29, 2025
@taylor-swanson taylor-swanson added enhancement New feature or request Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Oct 29, 2025
@taylor-swanson
feat: Preserve event.original when errors occur in pipelines
fe91965 
- Added append processor to global on_failure to preserve event original
- Added append processor to default pipelines to preserve event original if error.message is set

Affects the following integrations:

- sophos
- squid
- stormshield
- suricata
- syslog_router
- tetragon
- watchguard_firebox
- zeek
@taylor-swanson
taylor-swanson force-pushed the chore/event-original-part4 branch from e65a9c2 to fe91965 Compare October 29, 2025 17:44
@elasticmachine

elasticmachine commented Oct 29, 2025

Copy link
Copy Markdown

💚 Build Succeeded

cc @taylor-swanson
@taylor-swanson
taylor-swanson marked this pull request as ready for review November 4, 2025 20:25
@taylor-swanson
taylor-swanson requested a review from a team as a code owner November 4, 2025 20:25
@elasticmachine

elasticmachine commented Nov 4, 2025

Copy link
Copy Markdown

Pinging @elastic/integration-experience (Team:Integration-Experience)
@taylor-swanson
taylor-swanson merged commit 061b0cc into elastic:main Nov 6, 2025
7 checks passed
@taylor-swanson
taylor-swanson deleted the chore/event-original-part4 branch November 6, 2025 17:09
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package cilium_tetragon - 0.3.0 containing this change is available at https://epr.elastic.co/package/cilium_tetragon/0.3.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package sophos - 3.16.0 containing this change is available at https://epr.elastic.co/package/sophos/3.16.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package squid - 1.4.0 containing this change is available at https://epr.elastic.co/package/squid/1.4.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package stormshield - 1.4.0 containing this change is available at https://epr.elastic.co/package/stormshield/1.4.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package suricata - 2.26.0 containing this change is available at https://epr.elastic.co/package/suricata/2.26.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package syslog_router - 0.4.0 containing this change is available at https://epr.elastic.co/package/syslog_router/0.4.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package watchguard_firebox - 1.5.0 containing this change is available at https://epr.elastic.co/package/watchguard_firebox/1.5.0/
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Nov 6, 2025

Copy link
Copy Markdown
Contributor

Package zeek - 3.1.0 containing this change is available at https://epr.elastic.co/package/zeek/3.1.0/
tehbooom pushed a commit to tehbooom/integrations that referenced this pull request Nov 19, 2025
@taylor-swanson
feat: Preserve event.original when errors occur in pipelines (elastic…
8c79ac4 
…#15806)

- Added append processor to global on_failure to preserve event original
- Added append processor to default pipelines to preserve event original if error.message is set

Affects the following integrations:

- sophos
- squid
- stormshield
- suricata
- syslog_router
- tetragon
- watchguard_firebox
- zeek
@ilyannn ilyannn mentioned this pull request Nov 29, 2025
Closed
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:cilium_tetragon Cilium Tetragon Integration:sophos Sophos Integration:squid Squid Proxy Integration:stormshield StormShield SNS Integration:suricata Suricata Integration:syslog_router Syslog Router Integration:watchguard_firebox WatchGuard Firebox Integration:zeek Zeek Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

3 participants

@taylor-swanson @elasticmachine @haetamoudi