- Notifications
You must be signed in to change notification settings - Fork545
sailpoint_identity_sc: pass events as serialised json strings#15359
sailpoint_identity_sc: pass events as serialised json strings#15359efd6 merged 4 commits intoelastic:mainfrom
Conversation
This makes it possible to users who are passing events through logstashto use the agent.Also improve ingest pipeline error handling.
22188dc tocb71252Compare🚀 Benchmarks reportTo see the full report comment with |
elasticmachine commentedSep 16, 2025
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
| - set: | ||
| field: ecs.version | ||
| value: "8.11.0" | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Should we add in theterminate processor now too while doing this clean up?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
I thought about that and the CEL does not gracefully handle non-200 status codes. I'll add that too.
| - remove: | ||
| field: message | ||
| ignore_missing: true | ||
| if: ctx.event?.original != null | ||
| - rename: | ||
| field: message | ||
| target_field: event.original | ||
| ignore_missing: true | ||
| if: ctx.event?.original == null |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Would this logic be unnecessary if the CEL program were made to populate onlyevent.original?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others.Learn more.
Considering the context of the bug that this is fixing, that could be a breaking change (it's not for the op of the issue, but it could be for someone else with a similar data flow).
dc09c1b tof83e863Compareelasticmachine commentedSep 17, 2025
💚 Build Succeeded
History
cc@efd6 |
|
27a870e intoelastic:mainUh oh!
There was an error while loading.Please reload this page.
Package sailpoint_identity_sc - 1.2.0 containing this change is available athttps://epr.elastic.co/package/sailpoint_identity_sc/1.2.0/ |
…c#15359)This makes it possible to users who are passing events through logstashto use the agent.Also improve agent request, and ingest pipeline error handling.
…c#15359)This makes it possible to users who are passing events through logstashto use the agent.Also improve agent request, and ingest pipeline error handling.
Uh oh!
There was an error while loading.Please reload this page.
Proposed commit message
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues
Screenshots