Skip to content

Commit b2133eb

Browse files
kcreddykcreddy
committed
ssi_all: use triple-brace Mustache templating in ingest pipelines
Fix remaining double-brace Mustache template variables in ingest pipelines for packages owned by elastic/security-service-integrations. This is a follow-up to #11314 which addressed most packages but missed some. Affected packages: admin_by_request_epm, aws_securityhub, beyondinsight_password_safe, bitsight, cloudflare, cloudflare_logpush, google_workspace, m365_defender, microsoft_exchange_online_message_trace, rapid7_insightvm, sentinel_one, tenable_ot_security, ti_cif3. Relates: #7641 [git-generate] for f in $( ( for p in $( for f in packages/*/manifest.yml; do if yq -e 'select(.owner.github == "elastic/security-service-integrations")' "$f" >/dev/null 2>&1; then dirname "$f" fi done ); do rg -l '(^|[^{])\{\{[^{][ .a-zA-Z0-9_]*[^}]\}\}($|[^}])' -g '*.yml' "$p" || true done )|grep "elasticsearch/ingest_pipeline"|sort|uniq ); do perl -pi -e 's/(?<!\{)(\{\{[^{][ .a-zA-Z0-9_]*[^}]}})(?!\})/{$1}/g' $f done for p in $(git diff --name-only HEAD~1|cut -d/ -f1,2|sort|uniq); do ( cd $p elastic-package test pipeline -g elastic-package changelog add \ --description "Use triple-brace Mustache templating when referencing variables in ingest pipelines." \ --type bugfix \ --next patch \ --link #17623 )>/dev/null 2>&1 done
1 parent d9c5373 commit b2133eb

68 files changed

Lines changed: 211 additions & 185 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎packages/admin_by_request_epm/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
- version: "1.1.2"
2+
changes:
3+
- description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.
4+
type: bugfix
5+
link: https://github.com/elastic/integrations/pull/17623
16
- version: "1.1.1"
27
changes:
38
- description: Mark API key as secret in manifest.

‎packages/admin_by_request_epm/data_stream/auditlog/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -111,7 +111,7 @@ processors:
111111

112112
- append:
113113
field: related.user
114-
value: '{{admin_by_request_epm.auditlog.user.full_name}}'
114+
value: '{{{admin_by_request_epm.auditlog.user.full_name}}}'
115115
allow_duplicates: false
116116
if: ctx.admin_by_request_epm.auditlog.user.full_name != null
117117

@@ -122,7 +122,7 @@ processors:
122122

123123
- append:
124124
field: related.user
125-
value: '{{admin_by_request_epm.auditlog.user.email}}'
125+
value: '{{{admin_by_request_epm.auditlog.user.email}}}'
126126
allow_duplicates: false
127127
if: ctx.admin_by_request_epm.auditlog.user.email != null
128128

@@ -133,7 +133,7 @@ processors:
133133

134134
- append:
135135
field: related.hosts
136-
value: '{{admin_by_request_epm.auditlog.computer.name}}'
136+
value: '{{{admin_by_request_epm.auditlog.computer.name}}}'
137137
allow_duplicates: false
138138
if: ctx.admin_by_request_epm.auditlog.computer.name != null
139139

@@ -159,7 +159,7 @@ processors:
159159

160160
- append:
161161
field: related.hash
162-
value: '{{admin_by_request_epm.auditlog.application.sha256}}'
162+
value: '{{{admin_by_request_epm.auditlog.application.sha256}}}'
163163
allow_duplicates: false
164164
if: ctx.admin_by_request_epm.auditlog.application?.sha256 != null
165165

‎packages/admin_by_request_epm/data_stream/events/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ processors:
112112

113113
- append:
114114
field: related.hosts
115-
value: '{{admin_by_request_epm.events.computer_name}}'
115+
value: '{{{admin_by_request_epm.events.computer_name}}}'
116116
allow_duplicates: false
117117
if: ctx.admin_by_request_epm.events.computer_name != null
118118

@@ -143,7 +143,7 @@ processors:
143143

144144
- append:
145145
field: related.hash
146-
value: '{{admin_by_request_epm.events.application.sha256}}'
146+
value: '{{{admin_by_request_epm.events.application.sha256}}}'
147147
allow_duplicates: false
148148
if: ctx.admin_by_request_epm.events.application?.sha256 != null
149149

‎packages/admin_by_request_epm/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.3.0
22
name: admin_by_request_epm
33
title: Admin By Request EPM
4-
version: "1.1.1"
4+
version: "1.1.2"
55
source:
66
license: "Elastic-2.0"
77
description: "Collect logs from Admin By Request EPM with Elastic Agent."

‎packages/aws_securityhub/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "0.2.1"
3+
changes:
4+
- description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/17623
27
- version: "0.2.0"
38
changes:
49
- description: Removed ECS field definitions from CDR transform destinations, now covered by ecs@mappings component template. Renamed overridden ECS fields files to ecs-overridden.yml.

‎packages/aws_securityhub/data_stream/finding/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2004,7 +2004,7 @@ processors:
20042004
- set:
20052005
field: aws_securityhub.finding.transform_unique_id
20062006
tag: set_transform_unique_id
2007-
value: '{{event.id}}|{{vulnerability.id}}|{{resource.id}}|{{package.name}}|{{package.version}}'
2007+
value: '{{{event.id}}}|{{{vulnerability.id}}}|{{{resource.id}}}|{{{package.name}}}|{{{package.version}}}'
20082008
if: |-
20092009
ctx.aws_securityhub?.finding?.class_uid == '2002' &&
20102010
ctx.package?.name != null &&

‎packages/aws_securityhub/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.5.0
22
name: aws_securityhub
33
title: "AWS Security Hub"
4-
version: 0.2.0
4+
version: 0.2.1
55
source:
66
license: "Elastic-2.0"
77
description: Collect logs from AWS Security Hub with Elastic Agent.

‎packages/beyondinsight_password_safe/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
- version: "0.12.3"
2+
changes:
3+
- description: Use triple-brace Mustache templating when referencing variables in ingest pipelines.
4+
type: bugfix
5+
link: https://github.com/elastic/integrations/pull/17623
16
- version: "0.12.2"
27
changes:
38
- description: Do not set password if it is null or empty. Do not use password in authorization if it is not set.

‎packages/beyondinsight_password_safe/data_stream/asset/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -162,5 +162,5 @@ on_failure:
162162
field: error.message
163163
value: >-
164164
Processor '{{{ _ingest.on_failure_processor_type }}}'
165-
{{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
166-
{{/_ingest.on_failure_processor_tag}}failed with message '{{{ _ingest.on_failure_message }}}'
165+
{{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
166+
{{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'

‎packages/beyondinsight_password_safe/data_stream/managedaccount/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -179,5 +179,5 @@ on_failure:
179179
field: error.message
180180
value: >-
181181
Processor '{{{ _ingest.on_failure_processor_type }}}'
182-
{{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
183-
{{/_ingest.on_failure_processor_tag}}failed with message '{{{ _ingest.on_failure_message }}}'
182+
{{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
183+
{{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'

0 commit comments

Comments
 (0)