Re-adding pipeline changes removed by mistake (elastic#1353)

* re-add functionality which was accidentally removed * add changes * changelog
build-security · Jul 26, 2021 · f8fa10e · f8fa10e
1 parent e8926a9
commit f8fa10e
Show file tree

Hide file tree

Showing 3 changed files with 29 additions and 1 deletion.
diff --git a/packages/azure/changelog.yml b/packages/azure/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.5.1"
+  changes:
+    - description: Re-add pipeline changes for invalid json
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/1353
 - version: "0.5.0"
   changes:
     - description: Add input groups

diff --git a/packages/azure/data_stream/platformlogs/elasticsearch/ingest_pipeline/default.yml b/packages/azure/data_stream/platformlogs/elasticsearch/ingest_pipeline/default.yml
@@ -23,6 +23,29 @@ processors:
   - json:
       field: event.original
       target_field: azure.platformlogs
+      on_failure:
+        - grok:
+            field: event.original
+            patterns:
+              - "resourceId\": ?\"%{DATA:azure.platformlogs.resourceId}\""
+            ignore_failure: true
+            ignore_missing: true
+        - grok:
+            field: event.original
+            patterns:
+              - "category\": ?\"%{DATA:azure.platformlogs.category}\""
+            ignore_failure: true
+            ignore_missing: true
+        - grok:
+            field: event.original
+            patterns:
+              - "time\": ?\"%{DATA:azure.platformlogs.time}\""
+            ignore_failure: true
+            ignore_missing: true
+        - set:
+            field: error.message
+            value: 'invalid json log'
+            ignore_failure: true
   - date:
       field: azure.platformlogs.time
       target_field: '@timestamp'

diff --git a/packages/azure/manifest.yml b/packages/azure/manifest.yml
@@ -1,6 +1,6 @@
 name: azure
 title: Azure Logs
-version: 0.5.0
+version: 0.5.1
 release: beta
 description: Azure Logs Integration
 type: integration