f5_bigip: Fix ASM script processor when event.original is absent.
#11027
Conversation
andrewkroh
added
bugfix
kcreddy
added
the
Team:Security-Service Integrations
🚀 Benchmarks reportTo see the full report comment with |
💚 Build Succeeded
cc @kcreddy |
|
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
| def log; | ||
| if (ctx.event?.original != null) { | ||
| log = ctx.event.original; | ||
| } else if (ctx.json?.originalRawData != null) { |
There was a problem hiding this comment.
Do we have any documentation that explains originalRawData? It does seem pretty obvious, but it would be nice to have a reference to it — I was unable to find anything.
There was a problem hiding this comment.
Let me check and add if I find anything 👍🏼
There was a problem hiding this comment.
Unfortunately not documented. https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/output-example.html#asm-request-log
|
Package f5_bigip - 1.19.1 containing this change is available at https://epr.elastic.co/search?package=f5_bigip |
…lastic#11027) Fix ASM script processor when `event.original` is absent. There are cases when logstash is involved, the `event.original` is missing even when `preserve_original_event` is enabled. This leads to one of the ASM script processor to fail. This script processor doesn't have null-check on `event.original` field which leads to the error. This PR adds a null-check on `event.original` field to prevent this error.
…lastic#11027) Fix ASM script processor when `event.original` is absent. There are cases when logstash is involved, the `event.original` is missing even when `preserve_original_event` is enabled. This leads to one of the ASM script processor to fail. This script processor doesn't have null-check on `event.original` field which leads to the error. This PR adds a null-check on `event.original` field to prevent this error.
Proposed commit message
Fix ASM script processor when
event.originalis absent.There are cases when logstash is involved, the
event.originalis missingeven when
preserve_original_eventis enabled. This leads to one of the ASMscript processor to fail. This script processor doesn't have null-check on
event.originalfield which leads to the error.This PR adds a null-check on
event.originalfield to prevent this error.(Note for reviewers: Change best viewed with
Hide whitespace)Checklist
changelog.ymlfile.