Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Filebeat - 8.15.3 - Azure AuditLogs - IPv6 Parsing issue #41591

Open
novaksam opened this issue Nov 11, 2024 · 1 comment
Open

Filebeat - 8.15.3 - Azure AuditLogs - IPv6 Parsing issue #41591

novaksam opened this issue Nov 11, 2024 · 1 comment
Labels
needs_team Indicates that the issue/PR needs a Team:* label

Comments

@novaksam
Copy link

novaksam commented Nov 11, 2024 •
edited
Loading

I upgraded to filebeat 8.15.3 and observed that I was having errors generate in the output log. Closer inspection showed that the ingest pipeline was failing to parsing IPv6 addresses.

My example log had a callerIPAddress of 2603:1036:301:207e::5 which was being picked up by the topmost grok parser, resulting in failed to parse field [source.ip] of type [ip] in document ... "'2600' is not an IP string literal.\" errors.

beats/x-pack/filebeat/module/azure/auditlogs/ingest/pipeline.yml

Line 91 in 076ea50

- "%{IPORHOST:source.ip}"

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Nov 11, 2024
@botelastic
Copy link

botelastic bot commented Nov 11, 2024

This issue doesn't have a Team:<team> label.

@novaksam novaksam changed the title Filbeat - 8.15.3 - Azure AuditLogs - IPv6 Parsing issue Filebeat - 8.15.3 - Azure AuditLogs - IPv6 Parsing issue Nov 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
needs_team Indicates that the issue/PR needs a Team:* label
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@novaksam