Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make event.original available to the custom pipeline #7636

Closed
termcap opened this issue Sep 1, 2023 · 2 comments
Closed

Make event.original available to the custom pipeline #7636

termcap opened this issue Sep 1, 2023 · 2 comments
Labels

Comments

@termcap
Copy link

termcap commented Sep 1, 2023

Currently for the Nginx integration the the managed pipeline copies the message into event.original and then removes message. Once the pipeline is run, event.original is also removed.

Due to this event.original is not available to the custom pipeline setup by the user. The current work around is to toggle the preserve original event option in the integration, but this leads to two scenarios.

1 - If the user wants to actually preserve the original event, this is a good workaround.
2 - If the user does not want to preserve the original event, then the user has to remove the event.original as the last processor of the custom pipeline, but this creates an inconsistency as the integration has preserve original event enabled but the pipeline deletes the event.original

This may be applicable to all integrations and not just Nginx.

@termcap termcap changed the title Make event.original available to the custon pipeline Make event.original available to the custom pipeline Sep 1, 2023
@jsoriano
Copy link
Member

jsoriano commented Sep 5, 2023

By suggestion from @bhapas, issue created to discuss about moving the removal of the field to the Fleet final pipeline: elastic/kibana#165668.

@botelastic
Copy link

botelastic bot commented Sep 4, 2024

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants