Skip to content

Commit ab7dba9

Browse files
giorgi-imerlishvili-elasticgiorgi-imerlishvili-elastic
authored
[Azure App Service] bug fixes (#15591)
fix Missing azure.subscription_id fix Expects JSON object but is unparsed JSON string
1 parent 3a6691a commit ab7dba9

13 files changed

+235
-29
lines changed

‎packages/azure_app_service/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "0.10.0"
3+
changes:
4+
- description: Fix json parsing and missing azure.subscription_id issues
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/15591
27
- version: "0.9.0"
38
changes:
49
- description: Update readme

‎packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,13 @@
1313
"result_description": "Exception on /favicon.ico [GET]"
1414
},
1515
"resource": {
16-
"id": "/SUBSCRIPTIONS/0E072EC1-C22F-44L8-ADDE-DA36ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86"
16+
"id": "/SUBSCRIPTIONS/0E072EC1-C22F-44L8-ADDE-DA36ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86",
17+
"provider": "MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86"
1718
}
1819
},
20+
"cloud": {
21+
"provider": "azure"
22+
},
1923
"ecs": {
2024
"version": "8.11.0"
2125
},
@@ -39,9 +43,13 @@
3943
"result_description": "hi there"
4044
},
4145
"resource": {
42-
"id": "/SUBSCRIPTIONS/0E0733C1-C22F-4408-ADDE-DA35XD609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86"
46+
"id": "/SUBSCRIPTIONS/0E0733C1-C22F-4408-ADDE-DA35XD609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86",
47+
"provider": "MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86"
4348
}
4449
},
50+
"cloud": {
51+
"provider": "azure"
52+
},
4553
"ecs": {
4654
"version": "8.11.0"
4755
},

‎packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceauditlogs-raw.log-expected.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,18 @@
1515
}
1616
},
1717
"resource": {
18-
"id": "/SUBSCRIPTIONS/12CABCB5-36E8-104F-A3D2-1DC9982F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/USER-TEST-APP"
19-
}
18+
"group": "USER-TEST",
19+
"id": "/SUBSCRIPTIONS/12CABCB5-36E8-104F-A3D2-1DC9982F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/USER-TEST-APP",
20+
"name": "USER-TEST-APP",
21+
"provider": "MICROSOFT.WEB/SITES"
22+
},
23+
"subscription_id": "12CABCB5-36E8-104F-A3D2-1DC9982F45CA"
24+
},
25+
"cloud": {
26+
"account": {
27+
"id": "12CABCB5-36E8-104F-A3D2-1DC9982F45CA"
28+
},
29+
"provider": "azure"
2030
},
2131
"ecs": {
2232
"version": "8.11.0"

‎packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceconsolelogs-raw.log-expected.json‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,18 @@
1616
"result_description": " Request for index page received\n\n"
1717
},
1818
"resource": {
19-
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86"
20-
}
19+
"group": "LUCIAN.DEACONESCU_RG_6914",
20+
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86",
21+
"name": "MANGO-TREE-3004D00656084194B08980B8DB637B86",
22+
"provider": "MICROSOFT.WEB/SITES"
23+
},
24+
"subscription_id": "0E073EC1-C22F-4488-ADDE-DA35ED609CCD"
25+
},
26+
"cloud": {
27+
"account": {
28+
"id": "0E073EC1-C22F-4488-ADDE-DA35ED609CCD"
29+
},
30+
"provider": "azure"
2131
},
2232
"ecs": {
2333
"version": "8.11.0"
@@ -45,8 +55,18 @@
4555
"result_description": " 169.254.129.1 - - [16/Feb/2023:08:28:44 +0000] \"GET / HTTP/1.1\" 200 1469 \"https://sandbox-92-3.reactblade.portal.azure.net/\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\"\n\n"
4656
},
4757
"resource": {
48-
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86"
49-
}
58+
"group": "LUCIAN.DEACONESCU_RG_6914",
59+
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86",
60+
"name": "MANGO-TREE-3004D00656084194B08980B8DB637B86",
61+
"provider": "MICROSOFT.WEB/SITES"
62+
},
63+
"subscription_id": "0E073EC1-C22F-4488-ADDE-DA35ED609CCD"
64+
},
65+
"cloud": {
66+
"account": {
67+
"id": "0E073EC1-C22F-4488-ADDE-DA35ED609CCD"
68+
},
69+
"provider": "azure"
5070
},
5171
"ecs": {
5272
"version": "8.11.0"

‎packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
{"time": "2022-12-14T12:18:26.4843064Z", "resourceId": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST", "category": "AppServiceHTTPLogs", "properties": {"CsMethod":"POST","CsUriStem":"/api/command","SPort":"443","CIp":"81.2.69.142","UserAgent":"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36","CsHost":"user-test.scm.azurewebsites.net","ScStatus":200,"ScSubStatus":"0","ScWin32Status":"0","ScBytes":778,"CsBytes":1523,"TimeTaken":1793,"Result":"Success","Cookie":"-","CsUriQuery":"X-ARR-LOG-ID=820d6db3-32ed-4b18-b1d2-2ce575080071","CsUsername":"-","Referer":"-","ComputerName":"WEBWK00000A"}}
2-
{ "time": "2022-12-14T12:18:26.4844541Z", "resourceId": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST", "category": "AppServiceHTTPLogs", "properties": {"CsMethod":"POST","CsUriStem":"/api/command","SPort":"443","CIp":"81.2.69.142","UserAgent":"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36","CsHost":"user-test.scm.azurewebsites.net","ScStatus":200,"ScSubStatus":"0","ScWin32Status":"0","ScBytes":778,"CsBytes":1523,"TimeTaken":2578,"Result":"Success","Cookie":"-","CsUriQuery":"X-ARR-LOG-ID=3a3ea033-7afc-46fb-8cfc-9d1495fca2f1","CsUsername":"-","Referer":"-","ComputerName":"WEBWK00000A"}}
2+
{ "time": "2022-12-14T12:18:26.4844541Z", "resourceId": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST", "category": "AppServiceHTTPLogs", "properties": {"CsMethod":"POST","CsUriStem":"/api/command","SPort":"443","CIp":"81.2.69.142","UserAgent":"Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/108.0.0.0+Safari/537.36","CsHost":"user-test.scm.azurewebsites.net","ScStatus":200,"ScSubStatus":"0","ScWin32Status":"0","ScBytes":778,"CsBytes":1523,"TimeTaken":2578,"Result":"Success","Cookie":"-","CsUriQuery":"X-ARR-LOG-ID=3a3ea033-7afc-46fb-8cfc-9d1495fca2f1","CsUsername":"-","Referer":"-","ComputerName":"WEBWK00000A"}}
3+
{"EventIpAddress":"10.81.0.124","EventPrimaryStampName":"waws-prod-am2-713","EventStampName":"waws-prod-am2-713","EventStampType":"Stamp","EventTime":"2024-09-18T09:18:29.9152940Z","Host":"ln1xsdlwk0004MD","category":"AppServiceHTTPLogs","properties":"{\"CsHost\":\"example-markdown-app.azurewebsites.net\",\"CIp\":\"127.0.0.1\",\"SPort\":\"80\",\"CsUriStem\":\"\\/\",\"CsUriQuery\":\"\",\"CsMethod\":\"GET\",\"TimeTaken\":3,\"ScStatus\":\"200\",\"Result\":\"Success\",\"CsBytes\":\"864\",\"ScBytes\":\"25461\",\"UserAgent\":\"AlwaysOn\",\"Cookie\":\"ARRAffinity: b0f7ccff73d8f5b99c618b9e3364188a9c2dd5dc940d410dae189af480498532; \",\"CsUsername\":\"\",\"Referer\":\"\",\"ComputerName\":\"ln1xsdlwk0004MD\",\"Protocol\":\"HTTP\\/1.1\"}","resourceId":"/SUBSCRIPTIONS/12345678-1234-1234-1234-1234567890AB/RESOURCEGROUPS/EXAMPLE-BICEP-APP-SERVICE/PROVIDERS/MICROSOFT.WEB/SITES/EXAMPLE-MARKDOWN-APP","time":"2024-09-18T09:18:29.9152940Z"}

‎packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicehttplogs-raw.log-expected.json‎

Lines changed: 79 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,18 @@
2727
}
2828
},
2929
"resource": {
30-
"id": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST"
31-
}
30+
"group": "USER-TEST",
31+
"id": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST",
32+
"name": "APP-TEST",
33+
"provider": "MICROSOFT.WEB/SITES"
34+
},
35+
"subscription_id": "12CA3CB4-86E8-404F-A352-1DC1000F45CA"
36+
},
37+
"cloud": {
38+
"account": {
39+
"id": "12CA3CB4-86E8-404F-A352-1DC1000F45CA"
40+
},
41+
"provider": "azure"
3242
},
3343
"ecs": {
3444
"version": "8.11.0"
@@ -67,8 +77,18 @@
6777
}
6878
},
6979
"resource": {
70-
"id": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST"
71-
}
80+
"group": "USER-TEST",
81+
"id": "/SUBSCRIPTIONS/12CA3CB4-86E8-404F-A352-1DC1000F45CA/RESOURCEGROUPS/USER-TEST/PROVIDERS/MICROSOFT.WEB/SITES/APP-TEST",
82+
"name": "APP-TEST",
83+
"provider": "MICROSOFT.WEB/SITES"
84+
},
85+
"subscription_id": "12CA3CB4-86E8-404F-A352-1DC1000F45CA"
86+
},
87+
"cloud": {
88+
"account": {
89+
"id": "12CA3CB4-86E8-404F-A352-1DC1000F45CA"
90+
},
91+
"provider": "azure"
7292
},
7393
"ecs": {
7494
"version": "8.11.0"
@@ -79,6 +99,60 @@
7999
"tags": [
80100
"preserve_original_event"
81101
]
82-
}
102+
},
103+
{
104+
"@timestamp": "2024-09-18T09:18:29.915Z",
105+
"azure": {
106+
"app_service": {
107+
"category": "AppServiceHTTPLogs",
108+
"event_ip_address": "10.81.0.124",
109+
"event_primary_stamp_name": "waws-prod-am2-713",
110+
"event_stamp_name": "waws-prod-am2-713",
111+
"event_stamp_type": "Stamp",
112+
"host": "ln1xsdlwk0004MD",
113+
"properties": {
114+
"client_ip": "127.0.0.1",
115+
"computer_name": "ln1xsdlwk0004MD",
116+
"cookie": "ARRAffinity: b0f7ccff73d8f5b99c618b9e3364188a9c2dd5dc940d410dae189af480498532; ",
117+
"cs_bytes": 864,
118+
"cs_host": "example-markdown-app.azurewebsites.net",
119+
"cs_method": "GET",
120+
"cs_uri_query": "",
121+
"cs_uri_stem": "/",
122+
"cs_username": "",
123+
"protocol": "HTTP/1.1",
124+
"referer": "",
125+
"result": "Success",
126+
"s_port": "80",
127+
"sc_bytes": 25461,
128+
"sc_status": 200,
129+
"time_taken": 3,
130+
"user_agent": "AlwaysOn"
131+
}
132+
},
133+
"resource": {
134+
"group": "EXAMPLE-BICEP-APP-SERVICE",
135+
"id": "/SUBSCRIPTIONS/12345678-1234-1234-1234-1234567890AB/RESOURCEGROUPS/EXAMPLE-BICEP-APP-SERVICE/PROVIDERS/MICROSOFT.WEB/SITES/EXAMPLE-MARKDOWN-APP",
136+
"name": "EXAMPLE-MARKDOWN-APP",
137+
"provider": "MICROSOFT.WEB/SITES"
138+
},
139+
"subscription_id": "12345678-1234-1234-1234-1234567890AB"
140+
},
141+
"cloud": {
142+
"account": {
143+
"id": "12345678-1234-1234-1234-1234567890AB"
144+
},
145+
"provider": "azure"
146+
},
147+
"ecs": {
148+
"version": "8.11.0"
149+
},
150+
"event": {
151+
"original": "{\"EventIpAddress\":\"10.81.0.124\",\"EventPrimaryStampName\":\"waws-prod-am2-713\",\"EventStampName\":\"waws-prod-am2-713\",\"EventStampType\":\"Stamp\",\"EventTime\":\"2024-09-18T09:18:29.9152940Z\",\"Host\":\"ln1xsdlwk0004MD\",\"category\":\"AppServiceHTTPLogs\",\"properties\":\"{\\\"CsHost\\\":\\\"example-markdown-app.azurewebsites.net\\\",\\\"CIp\\\":\\\"127.0.0.1\\\",\\\"SPort\\\":\\\"80\\\",\\\"CsUriStem\\\":\\\"\\\\/\\\",\\\"CsUriQuery\\\":\\\"\\\",\\\"CsMethod\\\":\\\"GET\\\",\\\"TimeTaken\\\":3,\\\"ScStatus\\\":\\\"200\\\",\\\"Result\\\":\\\"Success\\\",\\\"CsBytes\\\":\\\"864\\\",\\\"ScBytes\\\":\\\"25461\\\",\\\"UserAgent\\\":\\\"AlwaysOn\\\",\\\"Cookie\\\":\\\"ARRAffinity: b0f7ccff73d8f5b99c618b9e3364188a9c2dd5dc940d410dae189af480498532; \\\",\\\"CsUsername\\\":\\\"\\\",\\\"Referer\\\":\\\"\\\",\\\"ComputerName\\\":\\\"ln1xsdlwk0004MD\\\",\\\"Protocol\\\":\\\"HTTP\\\\/1.1\\\"}\",\"resourceId\":\"/SUBSCRIPTIONS/12345678-1234-1234-1234-1234567890AB/RESOURCEGROUPS/EXAMPLE-BICEP-APP-SERVICE/PROVIDERS/MICROSOFT.WEB/SITES/EXAMPLE-MARKDOWN-APP\",\"time\":\"2024-09-18T09:18:29.9152940Z\"}"
152+
},
153+
"tags": [
154+
"preserve_original_event"
155+
]
156+
}
83157
]
84158
}

‎packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceipsecauditlogs-raw.log-expected.json‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,18 @@
2020
}
2121
},
2222
"resource": {
23-
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86"
24-
}
23+
"group": "LUCIAN.DEACONESCU_RG_6914",
24+
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86",
25+
"name": "MANGO-TREE-3004D00656084194B08980B8DB637B86",
26+
"provider": "MICROSOFT.WEB/SITES"
27+
},
28+
"subscription_id": "0E073EC1-C22F-4488-ADDE-DA35ED609CCD"
29+
},
30+
"cloud": {
31+
"account": {
32+
"id": "0E073EC1-C22F-4488-ADDE-DA35ED609CCD"
33+
},
34+
"provider": "azure"
2535
},
2636
"ecs": {
2737
"version": "8.11.0"

‎packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appservicesplatformlogs-raw.log-expected.json‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,18 @@
1515
"operation_name": "ContainerLogs"
1616
},
1717
"resource": {
18-
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609ACD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D0065608C194C08980B8DB637B86"
19-
}
18+
"group": "LUCIAN.DEACONESCU_RG_6914",
19+
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4488-ADDE-DA35ED609ACD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D0065608C194C08980B8DB637B86",
20+
"name": "MANGO-TREE-3004D0065608C194C08980B8DB637B86",
21+
"provider": "MICROSOFT.WEB/SITES"
22+
},
23+
"subscription_id": "0E073EC1-C22F-4488-ADDE-DA35ED609ACD"
24+
},
25+
"cloud": {
26+
"account": {
27+
"id": "0E073EC1-C22F-4488-ADDE-DA35ED609ACD"
28+
},
29+
"provider": "azure"
2030
},
2131
"ecs": {
2232
"version": "8.11.0"
@@ -43,8 +53,18 @@
4353
"operation_name": "ContainerLogs"
4454
},
4555
"resource": {
46-
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4438-ADBE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004E00656084194C08980B8DB637B86"
47-
}
56+
"group": "LUCIAN.DEACONESCU_RG_6914",
57+
"id": "/SUBSCRIPTIONS/0E073EC1-C22F-4438-ADBE-DA35ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004E00656084194C08980B8DB637B86",
58+
"name": "MANGO-TREE-3004E00656084194C08980B8DB637B86",
59+
"provider": "MICROSOFT.WEB/SITES"
60+
},
61+
"subscription_id": "0E073EC1-C22F-4438-ADBE-DA35ED609CCD"
62+
},
63+
"cloud": {
64+
"account": {
65+
"id": "0E073EC1-C22F-4438-ADBE-DA35ED609CCD"
66+
},
67+
"provider": "azure"
4868
},
4969
"ecs": {
5070
"version": "8.11.0"

‎packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-httplogs-inner-pipeline.yml‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@ processors:
88
- rename:
99
field: azure.app_service.properties.CIp
1010
target_field: azure.app_service.properties.client_ip
11+
- rename:
12+
field: azure.app_service.properties.Protocol
13+
target_field: azure.app_service.properties.protocol
14+
ignore_missing: true
1115
- rename:
1216
field: azure.app_service.properties.ComputerName
1317
target_field: azure.app_service.properties.computer_name
@@ -17,6 +21,10 @@ processors:
1721
- rename:
1822
field: azure.app_service.properties.CsBytes
1923
target_field: azure.app_service.properties.cs_bytes
24+
- convert:
25+
field: azure.app_service.properties.cs_bytes
26+
type: long
27+
ignore_missing: true
2028
- rename:
2129
field: azure.app_service.properties.CsHost
2230
target_field: azure.app_service.properties.cs_host
@@ -44,21 +52,54 @@ processors:
4452
- rename:
4553
field: azure.app_service.properties.ScBytes
4654
target_field: azure.app_service.properties.sc_bytes
55+
- convert:
56+
field: azure.app_service.properties.sc_bytes
57+
type: long
58+
ignore_missing: true
4759
- rename:
4860
field: azure.app_service.properties.ScStatus
4961
target_field: azure.app_service.properties.sc_status
62+
- convert:
63+
field: azure.app_service.properties.sc_status
64+
type: long
65+
ignore_missing: true
5066
- rename:
5167
field: azure.app_service.properties.ScSubStatus
5268
target_field: azure.app_service.properties.sc_substatus
69+
ignore_missing: true
5370
- rename:
5471
field: azure.app_service.properties.ScWin32Status
5572
target_field: azure.app_service.properties.sc_win32status
73+
ignore_missing: true
5674
- rename:
5775
field: azure.app_service.properties.TimeTaken
5876
target_field: azure.app_service.properties.time_taken
5977
- rename:
6078
field: azure.app_service.properties.UserAgent
6179
target_field: azure.app_service.properties.user_agent
80+
- rename:
81+
field: azure.app_service.EventIpAddress
82+
target_field: azure.app_service.event_ip_address
83+
ignore_missing: true
84+
- rename:
85+
field: azure.app_service.EventPrimaryStampName
86+
target_field: azure.app_service.event_primary_stamp_name
87+
ignore_missing: true
88+
- rename:
89+
field: azure.app_service.EventStampName
90+
target_field: azure.app_service.event_stamp_name
91+
ignore_missing: true
92+
- rename:
93+
field: azure.app_service.EventStampType
94+
target_field: azure.app_service.event_stamp_type
95+
ignore_missing: true
96+
- rename:
97+
field: azure.app_service.Host
98+
target_field: azure.app_service.host
99+
ignore_missing: true
100+
- remove:
101+
field: azure.app_service.EventTime
102+
ignore_missing: true
62103
on_failure:
63104
- append:
64105
field: "error.message"

‎packages/azure_app_service/data_stream/app_service_logs/elasticsearch/ingest_pipeline/appservice-platformlogs-inner-pipeline.yml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,11 @@ processors:
2424
field: azure.app_service.EventIpAddress
2525
target_field: azure.app_service.event_ip_address
2626
- rename:
27-
field: azure.app_service.properties
27+
field: azure.app_service.properties_raw
2828
target_field: azure.app_service.log
29+
- remove:
30+
field: azure.app_service.properties
31+
ignore_missing: true
2932
on_failure:
3033
- append:
3134
field: "error.message"

0 commit comments

Comments
 (0)