[Fortinet Fortiproxy] URL Field Parsing Errors - #19603
Conversation
…es on bare-path and special-character url fields
robester0403
added
bugfix
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
🚀 Benchmarks reportTo see the full report comment with |
Co-authored-by: Cursor <cursoragent@cursor.com>
5283dfe to
923bd46
Compare
| field: client.ip | ||
| if: ctx._fields_.clientip != null | ||
|
|
||
| - script: |
There was a problem hiding this comment.
I don't think the Painless script is necessary as you can also use the set processors to reconstruct the URL:
- set: temp.scheme <- url.scheme / network.protocol
- set: temp.url <- fields.url # if already http(s)://
- set: temp.url <- {{scheme}}://{{url.domain}}{{fields.url}}
...
| String scheme; | ||
| if (ctx.url?.scheme != null) { scheme = ctx.url.scheme.toString().toLowerCase(); } | ||
| else if (['http','https'].contains(ctx.network?.protocol)) { scheme = ctx.network.protocol; } | ||
| else if (ctx.server?.port instanceof Number && ctx.server.port == 443) { scheme = 'https'; } |
There was a problem hiding this comment.
I'm wary of special-casing 443 as HTTPS may very well be using a different port. Note there are no instances of ctx.server.port == 443 string in the current integrations codebase.
Perhaps the scheme will in fact be always present in these cases so we don't need to guess?
There was a problem hiding this comment.
Agreed, while 443 should be a safe guess, it's not always guaranteed to be https. Also, this wouldn't work at all for other port numbers.
Are there any other fields we can key off of to get the protocol/scheme? If not, then we shouldn't try to guess. url.full should be the full URL, but if we don't have the full URL in the event, or can't reliable build it, then we can't populate this field.
|
👀 I have started reviewing the PR |
Vera Review BotFor the current commit state, I did not find any issues. 🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
…ort 443 condition.
|
👀 I have started reviewing the PR |
|
✅ All changelog entries have the correct PR link. |
Vera Review BotFor the current commit state, I did not find any issues. 🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
💚 Build Succeeded
History
|
|
Tick the box to add this pull request to the merge queue (same as
|
|
Package fortinet_fortiproxy - 1.4.2 containing this change is available at https://epr.elastic.co/package/fortinet_fortiproxy/1.4.2/ |
3 participants
Proposed commit message
Fix URI parsing failures when url field contains only a path or query string.
Checklist
- [ ] I have verified that all data streams collect metrics or logs.changelog.ymlfile.- [ ] I have verified that Kibana version constraints are current according to guidelines.- [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practicesRelated issues
Resolves: #15111
Screenshots