Skip to content

x-pack/filebeat/input/cel: attempt to harmonise single events with ECS #45399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jul 22, 2025
Merged

x-pack/filebeat/input/cel: attempt to harmonise single events with ECS #45399

merged 1 commit into from
Jul 22, 2025

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Jul 15, 2025

Proposed commit message

x-pack/filebeat/input/cel: attempt to harmonise single events with ECS

If the object contains an error field, optimistically render the full
object as an ECS-compliant document, otherwise fall back to the
previously documented behaviour of rendering the document as an error.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

@efd6 efd6 self-assigned this Jul 15, 2025
@efd6 efd6 added enhancement Team:Security-Service Integrations Security Service Integrations Team backport-8.19 Automated backport to the 8.19 branch backport-9.1 Automated backport to the 9.1 branch labels Jul 15, 2025
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 15, 2025
@github-actions GitHub Actions
Copy link
Contributor

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jul 15, 2025 •
edited
Loading

🔍 Preview links for changed docs

@sajjantimalsina12

This comment was marked as off-topic.

Sign in to view
@mergify Mergify
Copy link
Contributor

mergify bot commented Jul 16, 2025

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 45254-cel upstream/45254-cel
git merge upstream/main
git push upstream 45254-cel

@efd6 efd6 marked this pull request as ready for review July 16, 2025 01:48
@efd6 efd6 requested review from a team as code owners July 16, 2025 01:48
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@efd6 efd6 force-pushed the 45254-cel branch 2 times, most recently from fdbc444 to 5e44b57 Compare July 16, 2025 01:49
@mergify Mergify
Copy link
Contributor

mergify bot commented Jul 17, 2025

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 45254-cel upstream/45254-cel
git merge upstream/main
git push upstream 45254-cel

@efd6
x-pack/filebeat/input/cel: attempt to harmonise single events with ECS
3fd3cc0 
If the object contains an error field, optimistically render the full
object as an ECS-compliant document, otherwise fall back to the
previously documented behaviour of rendering the document as an error.
@efd6 efd6 merged commit afb28b2 into elastic:main Jul 22, 2025
33 of 36 checks passed
mergify bot pushed a commit that referenced this pull request Jul 22, 2025
@efd6 @mergify
x-pack/filebeat/input/cel: attempt to harmonise single events with ECS (
ecb1dfa 
#45399)

If the object contains an error field, optimistically render the full
object as an ECS-compliant document, otherwise fall back to the
previously documented behaviour of rendering the document as an error.

(cherry picked from commit afb28b2)
mergify bot pushed a commit that referenced this pull request Jul 22, 2025
@efd6 @mergify
x-pack/filebeat/input/cel: attempt to harmonise single events with ECS (
0850682 
#45399)

If the object contains an error field, optimistically render the full
object as an ECS-compliant document, otherwise fall back to the
previously documented behaviour of rendering the document as an error.

(cherry picked from commit afb28b2)

# Conflicts:
#	docs/reference/filebeat/filebeat-input-cel.md
This was referenced Jul 22, 2025
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

@colleenmcginnis colleenmcginnis colleenmcginnis approved these changes

Assignees

@efd6 efd6

Labels
backport-8.19 Automated backport to the 8.19 branch backport-9.1 Automated backport to the 9.1 branch enhancement Team:Security-Service Integrations Security Service Integrations Team
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[Filebeat] Cel input logs single event object error incorrectly
5 participants
@efd6 @sajjantimalsina12 @elasticmachine @andrewkroh @colleenmcginnis