Skip to content

feat: Preserve event.original when pipeline errors in integration-experience integrations (part 1) #15798

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Nov 6, 2025
Merged

feat: Preserve event.original when pipeline errors in integration-experience integrations (part 1) #15798

merged 2 commits into from
Nov 6, 2025

Conversation

@taylor-swanson
Copy link
Contributor

@taylor-swanson taylor-swanson commented Oct 29, 2025 •
edited
Loading

Proposed commit message

  • Add append processor to pipeline on_failure handlers to preserve event.original.
  • Add append processor to pipeline to preserve event.original if error.message is set.

Integrations

  • arista_ngfw
  • cef
  • checkpoint
  • cisco_aironet
  • cisco_asa
  • cisco_ftd
  • cisco_ios
  • cisco_ise
  • cisco_nexus
  • cisco_secure_email_gateway

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
    - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

@taylor-swanson taylor-swanson self-assigned this Oct 29, 2025
@taylor-swanson taylor-swanson added enhancement New feature or request Integration:cef Common Event Format (CEF) Integration:checkpoint Check Point Integration:cisco_ise Cisco ISE Integration:cisco_nexus Cisco Nexus Integration:cisco_ios Cisco IOS Integration:cisco_ftd Cisco FTD Integration:cisco_asa Cisco ASA Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Integration:cisco_aironet Cisco Aironet (Community supported) Integration:arista_ngfw Arista NG Firewall (Community supported) Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Oct 29, 2025
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Oct 29, 2025 •
edited
Loading

🚀 Benchmarks report

Package cisco_aironet 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
log 2652.52 1992.03 -660.49 (-24.9%) 💔

Package cisco_asa 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
log 1156.07 773.4 -382.67 (-33.1%) 💔

Package cisco_ftd 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
log 1025.64 744.6 -281.04 (-27.4%) 💔

To see the full report comment with /test benchmark fullreport

@taylor-swanson taylor-swanson force-pushed the chore/event-original-part1 branch from 76ace3f to 019cb0b Compare October 29, 2025 17:22
@taylor-swanson taylor-swanson added Integration:cisco_asa Cisco ASA Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Integration:cisco_aironet Cisco Aironet (Community supported) labels Oct 29, 2025
@taylor-swanson
feat: Preserve event.original when errors occur in pipelines
f5da8c3 
- Added append processor to global on_failure to preserve event original
- Added append processor to default pipelines to preserve event original if error.message is set

Affects the following integrations:

- arista_ngfw
- cef
- checkpoint
- cisco_aironet
- cisco_asa
- cisco_ftd
- cisco_ios
- cisco_ise
- cisco_nexus
- cisco_secure_email_gateway
@taylor-swanson taylor-swanson force-pushed the chore/event-original-part1 branch from 019cb0b to f5da8c3 Compare October 29, 2025 17:53
@taylor-swanson taylor-swanson marked this pull request as ready for review November 4, 2025 20:24
@taylor-swanson taylor-swanson requested a review from a team as a code owner November 4, 2025 20:24
@elasticmachine
Copy link

elasticmachine commented Nov 4, 2025

Pinging @elastic/integration-experience (Team:Integration-Experience)

@taylor-swanson taylor-swanson enabled auto-merge (squash) November 6, 2025 17:09
@taylor-swanson taylor-swanson merged commit 47073ed into elastic:main Nov 6, 2025
7 checks passed
@elasticmachine
Copy link

elasticmachine commented Nov 6, 2025

💚 Build Succeeded

History

cc @taylor-swanson

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package arista_ngfw - 1.5.0 containing this change is available at https://epr.elastic.co/package/arista_ngfw/1.5.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cef - 2.22.0 containing this change is available at https://epr.elastic.co/package/cef/2.22.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package checkpoint - 1.42.0 containing this change is available at https://epr.elastic.co/package/checkpoint/1.42.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cisco_aironet - 1.18.0 containing this change is available at https://epr.elastic.co/package/cisco_aironet/1.18.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cisco_asa - 2.44.0 containing this change is available at https://epr.elastic.co/package/cisco_asa/2.44.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cisco_ftd - 3.12.0 containing this change is available at https://epr.elastic.co/package/cisco_ftd/3.12.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cisco_ios - 1.34.0 containing this change is available at https://epr.elastic.co/package/cisco_ios/1.34.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cisco_ise - 1.30.0 containing this change is available at https://epr.elastic.co/package/cisco_ise/1.30.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cisco_nexus - 1.5.0 containing this change is available at https://epr.elastic.co/package/cisco_nexus/1.5.0/

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Nov 6, 2025

Package cisco_secure_email_gateway - 1.28.0 containing this change is available at https://epr.elastic.co/package/cisco_secure_email_gateway/1.28.0/

@taylor-swanson taylor-swanson deleted the chore/event-original-part1 branch November 6, 2025 19:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@haetamoudi haetamoudi haetamoudi approved these changes

Assignees

@taylor-swanson taylor-swanson

Labels

enhancement New feature or request Integration:arista_ngfw Arista NG Firewall (Community supported) Integration:cef Common Event Format (CEF) Integration:checkpoint Check Point Integration:cisco_aironet Cisco Aironet (Community supported) Integration:cisco_asa Cisco ASA Integration:cisco_ftd Cisco FTD Integration:cisco_ios Cisco IOS Integration:cisco_ise Cisco ISE Integration:cisco_nexus Cisco Nexus Integration:cisco_secure_email_gateway Cisco Secure Email Gateway Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@taylor-swanson @elasticmachine @haetamoudi @andrewkroh