search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
100 stars 4.92k forks source link

Filebeat - 8.15.3 - Azure AuditLogs - IPv6 Parsing issue #41591

Open novaksam opened 2 days ago

novaksam commented 2 days ago

I upgraded to filebeat 8.15.3 and observed that I was having errors generate in the output log. Closer inspection showed that the ingest pipeline was failing to parsing IPv6 addresses.

My example log had a callerIPAddress of 2603:1036:301:207e::5 which was being picked up by the topmost grok parser, resulting in failed to parse field [source.ip] of type [ip] in document ... "'2600' is not an IP string literal.\" errors.

https://github.com/elastic/beats/blob/076ea50b314499ac91cc21c7f4d26be32c8cf901/x-pack/filebeat/module/azure/auditlogs/ingest/pipeline.yml#L91

botelastic[bot] commented 2 days ago

This issue doesn't have a Team:<team> label.