diff --git a/packages/syslog_router/changelog.yml b/packages/syslog_router/changelog.yml index 761a2f6ca4a..6eae19f2fab 100644 --- a/packages/syslog_router/changelog.yml +++ b/packages/syslog_router/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "0.3.1" + changes: + - description: Generate processor tags and normalize error handler. + type: enhancement + link: https://github.com/elastic/integrations/pull/15718 - version: "0.3.0" changes: - description: Add support for Cisco IOS. Matches on the Cisco emblem header. diff --git a/packages/syslog_router/data_stream/log/_dev/test/pipeline/test-syslog-events.json b/packages/syslog_router/data_stream/log/_dev/test/pipeline/test-syslog-events.json index 698048ae6e3..c3799988a84 100644 --- a/packages/syslog_router/data_stream/log/_dev/test/pipeline/test-syslog-events.json +++ b/packages/syslog_router/data_stream/log/_dev/test/pipeline/test-syslog-events.json @@ -1,15 +1,15 @@ { - "events": [ - { - "@timestamp": "2024-04-23T09:16:40.645Z", - "message": "Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-4-106023: Deny tcp src outside:192.168.19.254/80 dst inside:172.31.98.44/8277 by access-group \"inbound\" [0x0, 0x0]", - "_conf": { - "dataset": "cisco_asa.log" - } - }, - { - "@timestamp": "2024-04-23T09:16:40.645Z", - "message": "Custom log" - } - ] + "events": [ + { + "@timestamp": "2024-04-23T09:16:40.645Z", + "message": "Oct 10 2018 12:34:56 localhost CiscoASA[999]: %ASA-4-106023: Deny tcp src outside:192.168.19.254/80 dst inside:172.31.98.44/8277 by access-group \"inbound\" [0x0, 0x0]", + "_conf": { + "dataset": "cisco_asa.log" + } + }, + { + "@timestamp": "2024-04-23T09:16:40.645Z", + "message": "Custom log" + } + ] } \ No newline at end of file diff --git a/packages/syslog_router/data_stream/log/elasticsearch/ingest_pipeline/default.yml b/packages/syslog_router/data_stream/log/elasticsearch/ingest_pipeline/default.yml index 45aae79f51a..843f15f7d29 100644 --- a/packages/syslog_router/data_stream/log/elasticsearch/ingest_pipeline/default.yml +++ b/packages/syslog_router/data_stream/log/elasticsearch/ingest_pipeline/default.yml @@ -2,13 +2,18 @@ description: Pipeline for unmatched syslog events. processors: - set: + tag: set_ecs_version_135371bc field: ecs.version value: 8.16.0 on_failure: - append: field: error.message - value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + value: >- + Processor '{{{ _ingest.on_failure_processor_type }}}' + {{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}' + {{/_ingest.on_failure_processor_tag}}in pipeline '{{{ _ingest.pipeline }}}' + failed with message '{{{ _ingest.on_failure_message }}}' - set: field: event.kind value: pipeline_error diff --git a/packages/syslog_router/manifest.yml b/packages/syslog_router/manifest.yml index 3c96bbd239f..d0431707180 100644 --- a/packages/syslog_router/manifest.yml +++ b/packages/syslog_router/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.2.1 name: syslog_router title: "Syslog Router" -version: 0.3.0 +version: 0.3.1 description: "Route syslog events to integrations with Elastic Agent." type: integration categories: