-
Notifications
You must be signed in to change notification settings - Fork 518
[checkpoint] Update kv split for checkpoint #15745
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
taylor-swanson
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you add a pipeline test to verify the change behaves correctly?
Additionally, the version in manifest.yml needs to be updated to match the changelog (1.41.3)
Add a simplified test case
removed a space that crept in at the wrong location
|
@taylor-swanson I updated the changelog and added a test case in a hopefully sufficient way, as I shortened it considerably. The original message with all the headers would have been 24kb. |
Enhancement
Proposed commit message
This uses a more complex Regex to split the KV pairs in the Checkpoint message.
This is necessary if you use it to process email, as the headers might contain strings of the form:
X-IronPort-AV: E=Sophos;i=\\\"8.18,219,1756234400\\\"; d=\\\"png"; SophosThe original regex would regeard both examples as a split, when in reality they are not. Use (negative) lookbehind to box the kv split parameter in.
(?<!\\")(?<="); (?=\w)lookbehind:
(?<=")react to";but
negative lookbehind:
(?<!\\")do not react to\";lookahead:
(?=\w)expect a character after 1 (one) space:; abcdChecklist
changelog.ymlfile.How to test this PR locally
Check your logs/indices if any messages are rejected. Apply fix and check whether numbers go down..