Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[filebeat][aws][vpcflow] mapping errors on logs with "NODATA" & "SKIPDATA" log_status #22716

Closed
ynirk opened this issue Nov 23, 2020 · 1 comment · Fixed by #22721
Closed

[filebeat][aws][vpcflow] mapping errors on logs with "NODATA" & "SKIPDATA" log_status #22716

ynirk opened this issue Nov 23, 2020 · 1 comment · Fixed by #22721
Assignees
@kaiyan-sheng
Labels
Filebeat Filebeat Team:Platforms Label for the Integrations - Platforms team

Comments

@ynirk
Copy link

ynirk commented Nov 23, 2020

When testing filebeat 7.10.0 on AWS vpcflow, i noticed some parsing errors when aws.vpcflow.log_status is NODATA or SKIPDATA

With those status, the log line looks like the following:

version vpc-id subnet-id instance-id interface-id account-id - - - - - - - - - - start end - - SKIPDATA
version vpc-id subnet-id instance-id interface-id account-id - - - - - - - - - - start end - - NODATA

It generates mapping errors:

failed to parse field [aws.vpcflow.pkt_srcaddr] of type [ip] in document with id '229a9b7009-000001896666'. Preview of field's value: '-'
@ynirk ynirk added the Filebeat Filebeat label Nov 23, 2020
@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Nov 23, 2020
@andresrc andresrc added the Team:Platforms Label for the Integrations - Platforms team label Nov 23, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations-platforms (Team:Platforms)

@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Nov 23, 2020
@kaiyan-sheng kaiyan-sheng self-assigned this Nov 23, 2020
@kaiyan-sheng kaiyan-sheng mentioned this issue Nov 23, 2020
Merged
6 tasks
This was referenced Dec 1, 2020
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@kaiyan-sheng kaiyan-sheng

Labels
Filebeat Filebeat Team:Platforms Label for the Integrations - Platforms team
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Drop pkt_dstaddr and pkt_srcaddr when equals to "-"
4 participants
@andresrc @kaiyan-sheng @elasticmachine @ynirk