Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[azure] Handle single quotes objects inside message field #11728

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

zmoog
Copy link
Contributor

@zmoog zmoog commented Nov 13, 2024

Proposed commit message

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@zmoog zmoog self-assigned this Nov 13, 2024
@zmoog zmoog added Integration:azure Azure Logs bugfix Pull request that fixes a bug issue Team:obs-ds-hosted-services Label for the Observability Hosted Services team [elastic/obs-ds-hosted-services] labels Nov 13, 2024
@zmoog zmoog changed the title Handle single quotes objects inside message field [azure] Handle single quotes objects inside message field Nov 13, 2024
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 13, 2024

🚀 Benchmarks report

Package azure 👍(8) 💚(1) 💔(2)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
identity_protection 4464.29 3311.26 -1153.03 (-25.83%) 💔
provisioning 2898.55 2262.44 -636.11 (-21.95%) 💔

To see the full report comment with /test benchmark fullreport

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @zmoog

zmoog added a commit that referenced this pull request Nov 14, 2024
… a string value (#11732)

Mitigates #11729

If the `azure.platformlogs.properties` field contains a string instead of the expected object, the pipeline renames it as `azure.platformlogs.properties.raw` field. 

This allows:

- Elasticsearch to index the log events instead of dropping them (status 400)
- Users to customize parsing of the `.raw` field in the `logs-azure.platformlogs@custom pipeline`

This avoids dropping log events while we build a complete and more robust [invalid JSON](#11729) handling solution with #11728
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bugfix Pull request that fixes a bug issue Integration:azure Azure Logs Team:obs-ds-hosted-services Label for the Observability Hosted Services team [elastic/obs-ds-hosted-services]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants