Skip to content

[fortinet_fortigate] Generate processor tags and normalize error handler - #15540

Merged
taylor-swanson merged 2 commits into
elastic:mainfrom
taylor-swanson:enhance/tag-fortinet_fortigate
Oct 28, 2025
Merged

taylor-swanson merged 2 commits into
elastic:mainfrom
taylor-swanson:enhance/tag-fortinet_fortigate

Conversation

@taylor-swanson

@taylor-swanson taylor-swanson commented Oct 3, 2025 •

Copy link
Copy Markdown
Contributor

Proposed commit message

  • Generate tags for processors missing tags
  • Normalize the pipeline error handler

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
    - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

@taylor-swanson taylor-swanson self-assigned this Oct 3, 2025
@taylor-swanson taylor-swanson added enhancement New feature or request Integration:fortinet_fortigate Fortinet FortiGate Firewall Logs Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Oct 3, 2025
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@taylor-swanson
taylor-swanson marked this pull request as ready for review October 6, 2025 13:54
@taylor-swanson
taylor-swanson requested a review from a team as a code owner October 6, 2025 13:54
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/integration-experience (Team:Integration-Experience)

value: "{{{destination.nat.ip}}}"
if: ctx.destination?.nat?.ip != null
allow_duplicates: false
- append:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

out of curiosity, would this duplication set the field twice? can this trigger an error because of allow_duplicates: false?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, because allow_duplicates is false, it won't set it twice. As far as I know, it shouldn't show up as an error (but then again I don't know, as ignore_failure still yields an increase in the error count 🤷‍♂️)

The issue here is that the processor does have to actually check every element of related.ip, do a string comparison, and fail out when it finds the existing value in there already.

@taylor-swanson
taylor-swanson marked this pull request as draft October 21, 2025 16:49
- Generate tags for processors missing tags
- Normalize the pipeline error handler
@taylor-swanson
taylor-swanson force-pushed the enhance/tag-fortinet_fortigate branch from 606f678 to 381a7b5 Compare October 22, 2025 12:54
@taylor-swanson
taylor-swanson marked this pull request as ready for review October 22, 2025 13:25
@elasticmachine

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @taylor-swanson

@taylor-swanson
taylor-swanson merged commit 115d6fb into elastic:main Oct 28, 2025
7 checks passed
@taylor-swanson
taylor-swanson deleted the enhance/tag-fortinet_fortigate branch October 28, 2025 13:14
@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

Package fortinet_fortigate - 1.34.1 containing this change is available at https://epr.elastic.co/package/fortinet_fortigate/1.34.1/

tehbooom pushed a commit to tehbooom/integrations that referenced this pull request Nov 19, 2025
…ler (elastic#15540)

- Generate tags for processors missing tags
- Normalize the pipeline error handler
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:fortinet_fortigate Fortinet FortiGate Firewall Logs Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants