Skip to content

ssi: add processor tags and preserve_original_event on failure (2/4) #20573

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kcreddy merged 11 commits into from
Aug 21, 2026
Merged

ssi: add processor tags and preserve_original_event on failure (2/4) #20573

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
127f814
ssi: add processor tags and preserve_original_event on failure (2/4)
kcreddy Aug 6, 2026
36080f1
ssi: update changelog links to PR #20573
kcreddy Aug 6, 2026
7c6dd2b
Merge remote-tracking branch 'upstream/main' into tagging-evt-origina…
kcreddy Aug 6, 2026
d213df4
ssi: add processor tags and preserve_original_event on failure (2/4)
kcreddy Aug 11, 2026
4a728f0
Merge remote-tracking branch 'upstream/main' into tagging-evt-origina…
kcreddy Aug 11, 2026
73b319e
ssi: add processor tags and preserve_original_event on failure (2/4)
kcreddy Aug 13, 2026
59461ed
Merge remote-tracking branch 'upstream/main' into tagging-evt-origina…
kcreddy Aug 13, 2026
b20728c
Merge remote-tracking branch 'upstream/main' into tagging-evt-origina…
kcreddy Aug 18, 2026
475f9ee
Adress review comments
kcreddy Aug 20, 2026
4723f35
Merge remote-tracking branch 'upstream/main' into tagging-evt-origina…
kcreddy Aug 20, 2026
4afa90b
address review comments
kcreddy Aug 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
address review comments
  • Loading branch information
@kcreddy
kcreddy committed Aug 21, 2026
commit 4afa90bc6a4b1c7e80354c62ac10e6ad49310817
24 changes: 15 additions & 9 deletions packages/gcp/data_stream/audit/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,11 +143,14 @@ processors:
description: Appends any relevant entity to `related.entity` for all events
lang: painless
on_failure:
- set:
tag: set_error_message_679c76c6
description: Adds error reason to the document
- append:
tag: append_error_message_bd55f3fe
field: error.message
value: "{{{ _ingest.on_failure_message }}}"
value: >-
Processor '{{{ _ingest.on_failure_processor_type }}}'
{{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
{{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'
allow_duplicates: false
source: |
void addValue(Set entities, def value) {
if (value != null && value != "") {
Expand Down Expand Up @@ -262,11 +265,14 @@ processors:
description: Classify actor and target entities into type-specific fields
lang: painless
on_failure:
- set:
tag: set_error_message_f032c8ea
description: Adds error reason to the document
- append:
tag: append_error_message_47a05ef0
field: error.message
value: "{{{ _ingest.on_failure_message }}}"
value: >-
Processor '{{{ _ingest.on_failure_processor_type }}}'
{{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}'
{{{/_ingest.on_failure_processor_tag}}}failed with message '{{{ _ingest.on_failure_message }}}'
allow_duplicates: false
source: |
void addNestedValue(def currentCtx, String path, def value) {
if (value == null || value == "") {
Expand Down Expand Up @@ -574,7 +580,7 @@ processors:
- script:
lang: painless
description: set event.category and type for long running operation
tag: set-event-type-for-long-operations_9e495b64
tag: set_event_type_for_long_operations_9e495b64
if: ctx.json?.operation != null
source: |
def first = (ctx.json.operation.first == null) ? false : ctx.json.operation.first;
Expand Down
Loading