Skip to content

packages/sophos/xg: fix kv split and handle syslog headers - #2320

Merged
efd6 merged 2 commits into
elastic:masterfrom
efd6:sophos/xg
Jan 5, 2022
Merged

packages/sophos/xg: fix kv split and handle syslog headers#2320
efd6 merged 2 commits into
elastic:masterfrom
efd6:sophos/xg

Conversation

@efd6

@efd6 efd6 commented Dec 8, 2021

Copy link
Copy Markdown
Contributor

What does this PR do?

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

How to test this PR locally

Standard package testing.

Related issues

Screenshots

N/A
@efd6 efd6 added bug Something isn't working, use only for issues Team:Security-External Integrations 8.1-candidate labels Dec 8, 2021
@efd6
efd6 requested a review from P1llus December 8, 2021 05:07
@elasticmachine

elasticmachine commented Dec 8, 2021 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-12-16T05:43:34.000+0000

  • Duration: 23 min 43 sec

  • Commit: 243bab4

Test stats 🧪

Test Results
Failed 0
Passed 14
Skipped 0
Total 14

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.
@efd6
efd6 marked this pull request as ready for review December 8, 2021 06:10
@elasticmachine

elasticmachine commented Dec 8, 2021

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)
efd6
efd6 commented Dec 16, 2021
View reviewed changes

@efd6 efd6 left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The failing cases need a quote-aware split processor to pass.
Comment thread packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-xg.log-expected.json Outdated
Comment on lines 8599 to 8603

@efd6 efd6 Dec 16, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This failure is a fundamental inability for the KV processor to understand paired delimiters (quotes in this case) that make characters opaque.
Comment thread packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-xg.log-expected.json Outdated
Comment on lines 8717 to 8726

@efd6 efd6 Dec 16, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.
@efd6
efd6 merged commit 685e9b4 into elastic:master Jan 5, 2022
@efd6 efd6 mentioned this pull request Feb 23, 2022
Closed
@efd6
efd6 deleted the sophos/xg branch February 5, 2025 22:07
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@efd6
packages/sophos/xg: fix kv split and handle syslog headers (elastic#2320
f64118a 
)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

8.1-candidate bug Something isn't working, use only for issues Integration:sophos Sophos

4 participants

@efd6 @elasticmachine @adriansr @andrewkroh