Use ingest pipelines for forwarded data set #973
Conversation
marc-gr
added
enhancement
|
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
Trends 🧪 |
| name: '{{ IngestPipeline "security" }}' | ||
| if: ctx?.winlog?.channel != null && ctx?.winlog?.channel == "Security" | ||
| - pipeline: | ||
| name: '{{ IngestPipeline "powershell" }}' |
There was a problem hiding this comment.
@marc-gr Are we duplicating the Elasticsearch ingest pipelines from the other data streams here? I don't think there is any way around that now, and if we are then we should see if we can improve this situation through Fleet improvements.
Like perhaps the IngestPipeline function can be made to allow referencing pipelines from other data streams from the same package. Figuring out how to reuse the pipelines from other packages is probably harder unless we create a dependency mechanism so that the Windows package could depend on the security pipeline from the System package.
There was a problem hiding this comment.
Agree. Also this is also done in other packages iirc, so would be a benefit to do it and change these also.
|
Opened this elastic/package-spec#580 to keep track of the proposed enhancement |
What does this PR do?
Uses the existing pipelines in the forwarded data set.
Checklist
changelog.ymlfile.