[Fortinet Fortigate] Add url parsing error handling (#12895)

elastic · Mar 4, 2025 · ee6f8bb · ee6f8bb
1 parent 984ba31
commit ee6f8bb
Show file tree

Hide file tree

Showing 5 changed files with 18 additions and 1 deletion.
diff --git a/packages/fortinet_fortigate/changelog.yml b/packages/fortinet_fortigate/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.30.0"
+  changes:
+    - description: If url parsing fails, append failure message to error.message.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/12895
 - version: "1.29.2"
   changes:
     - description: Updated SSL description to be uniform and to include links to documentation.

diff --git a/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/event.yml b/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/event.yml
@@ -206,6 +206,10 @@ processors:
       target_field: url
       keep_original: false
       if: ctx.fortinet?.firewall?.url != null
+      on_failure:
+        - append:
+            field: error.message
+            value: "url parsing failed with message {{ _ingest.on_failure_message }}"
   # Need to do a set, then remove since rename w/ override
   # is not supported in 8.3.0
   - set:

diff --git a/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/traffic.yml b/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/traffic.yml
@@ -220,6 +220,10 @@ processors:
     target_field: url
     keep_original: false
     if: ctx.fortinet?.firewall?.url != null
+    on_failure:
+      - append:
+          field: error.message
+          value: "url parsing failed with message {{ _ingest.on_failure_message }}"
 - remove:
     field: fortinet.firewall.url
     ignore_missing: true

diff --git a/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/utm.yml b/packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/utm.yml
@@ -285,6 +285,10 @@ processors:
       target_field: url
       keep_original: false
       if: ctx.fortinet?.firewall?.url != null
+      on_failure:
+        - append:
+            field: error.message
+            value: "url parsing failed with message {{ _ingest.on_failure_message }}"
   # Need to do a set, then remove since rename w/ override
   # is not supported in 8.3.0
   - set:

diff --git a/packages/fortinet_fortigate/manifest.yml b/packages/fortinet_fortigate/manifest.yml
@@ -1,6 +1,6 @@
 name: fortinet_fortigate
 title: Fortinet FortiGate Firewall Logs
-version: "1.29.2"
+version: "1.30.0"
 description: Collect logs from Fortinet FortiGate firewalls with Elastic Agent.
 type: integration
 format_version: "3.0.3"