Allow empty fields in the exchange integration redux #12846
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
matthewscherer
added
New Integration
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
|
Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform) |
andrewkroh
reviewed
Feb 19, 2025
...rosoft_exchange_server/data_stream/messagetracking/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
...rosoft_exchange_server/data_stream/messagetracking/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
| "email": { | ||
| "from": { | ||
| "address": [ | ||
| "" |
There was a problem hiding this comment.
We don't want the empty string being added to the array.
…/elasticsearch/ingest_pipeline/default.yml Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
…/elasticsearch/ingest_pipeline/default.yml Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
matthewscherer
commented
Feb 19, 2025
| "address": [ | ||
| "support@example.com" | ||
| ] | ||
| "address": "support@example.com" |
There was a problem hiding this comment.
Is this supposed to be a list?
There was a problem hiding this comment.
I changed this back to a list, let me know if that is wrong.
matthewscherer
commented
Feb 19, 2025
| "address": [ | ||
| "root@pve-vhost01.my.domain.com" | ||
| ] | ||
| "address": "root@pve-vhost01.my.domain.com" |
There was a problem hiding this comment.
Is this supposed to be a list?
There was a problem hiding this comment.
I changed this back to a list, let me know if that is wrong.
🚀 Benchmarks reportTo see the full report comment with |
|
💚 Build Succeeded
History
|
5 tasks
andrewkroh
approved these changes
Feb 25, 2025
matthewscherer
deleted the
allow_empty_fields_in_the_exchange_integration_redux
branch
|
Package microsoft_exchange_server - 1.3.1 containing this change is available at https://epr.elastic.co/package/microsoft_exchange_server/1.3.1/ |
andrewkroh
removed
the
New Integration
flexitrev
pushed a commit
that referenced
this pull request
Mar 20, 2025
* Updated the yaml and the test log file. The expected output still needs to be generated. * Added ignore field and added new expected output. * Used elastic-package to generate a new changelog entry and manifest file. * Update packages/microsoft_exchange_server/data_stream/messagetracking/elasticsearch/ingest_pipeline/default.yml Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> * Update packages/microsoft_exchange_server/data_stream/messagetracking/elasticsearch/ingest_pipeline/default.yml Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co> * Updated the expected data. * Changed the sender address back to a list append. * Added a test for missing networkmessageid. --------- Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed commit message
A customer came across a couple log lines with missing networkmessageid and senderaddress fields. This in turn rejected the logs messages. Allowing these two fields to be empty or otherwise missing will allow them to pass the ingest function.
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Related issues