Skip to content

Conversation

@efd6
Copy link
Contributor

@efd6 efd6 commented Aug 7, 2025

Proposed commit message

x-pack/filebeat/input/httpjson: allow template termination without logging error

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

@efd6 efd6 self-assigned this Aug 7, 2025
@efd6 efd6 added enhancement Filebeat Filebeat bugfix Team:Security-Service Integrations Security Service Integrations Team backport-8.18 Automated backport to the 8.18 branch backport-9.0 Automated backport to the 9.0 branch backport-8.19 Automated backport to the 8.19 branch backport-9.1 Automated backport to the 9.1 branch labels Aug 7, 2025
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Aug 7, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Aug 7, 2025

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@github-actions
Copy link
Contributor

github-actions bot commented Aug 7, 2025

🔍 Preview links for changed docs

@efd6 efd6 marked this pull request as ready for review August 7, 2025 09:21
@efd6 efd6 requested review from a team as code owners August 7, 2025 09:21
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@mergify
Copy link
Contributor

mergify bot commented Aug 7, 2025

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 45664-httpjson upstream/45664-httpjson
git merge upstream/main
git push upstream 45664-httpjson

efd6 added 2 commits August 8, 2025 08:23
…gging error

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.
@efd6 efd6 requested a review from colleenmcginnis August 11, 2025 20:52
@efd6 efd6 merged commit f324f29 into elastic:main Aug 13, 2025
34 of 37 checks passed
mergify bot pushed a commit that referenced this pull request Aug 13, 2025
…gging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)

# Conflicts:
#	docs/reference/filebeat/filebeat-input-httpjson.md
#	x-pack/filebeat/input/httpjson/value_tpl.go
mergify bot pushed a commit that referenced this pull request Aug 13, 2025
…gging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)

# Conflicts:
#	docs/reference/filebeat/filebeat-input-httpjson.md
mergify bot pushed a commit that referenced this pull request Aug 13, 2025
…gging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)
mergify bot pushed a commit that referenced this pull request Aug 13, 2025
…gging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)
efd6 added a commit that referenced this pull request Aug 19, 2025
… termination without logging error (#45997)

* x-pack/filebeat/input/httpjson: allow template termination without logging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)

* remove irrelevant changelog entry

---------

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
Co-authored-by: Visha Angelova <91186315+vishaangelova@users.noreply.github.com>
efd6 added a commit that referenced this pull request Aug 19, 2025
… termination without logging error (#45996)

* x-pack/filebeat/input/httpjson: allow template termination without logging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)

* remove irrelevant changelog entries

---------

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
efd6 added a commit that referenced this pull request Aug 19, 2025
…e termination without logging error (#45994)

* x-pack/filebeat/input/httpjson: allow template termination without logging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)

# Conflicts:
#	docs/reference/filebeat/filebeat-input-httpjson.md

* remove markdown
* add asciidoc documentation

---------

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
efd6 added a commit that referenced this pull request Aug 19, 2025
…e termination without logging error (#45993)

* x-pack/filebeat/input/httpjson: allow template termination without logging error (#45810)

This adds a terminate helper that can be used to signal that a template
should terminate without an error. The termination can (should) be used
to report the reason for the termination which will be logged at DEBUG
level, but otherwise ignored.

(cherry picked from commit f324f29)

# Conflicts:
#	docs/reference/filebeat/filebeat-input-httpjson.md
#	x-pack/filebeat/input/httpjson/value_tpl.go

* remove irrelevant changelog entries

* remove markdown
* add asciidoc documentation
* resolve conflicts

---------

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
kcreddy added a commit to elastic/integrations that referenced this pull request Sep 22, 2025
…R) workflow (#15230)

aws: Add transforms to Config and Inspector data streams for extended protections (CDR) workflow.

- Add latest transform to Config and Inspector data streams
to help with Cloud Native Vulnerability Management (CNVM)[1] 
and Cloud Security Posture Management (CSPM)[2] workflows.
- Add ILM policy to AWS Config as it does full sync every interval.
- Update minimum kibana version to "^8.19.0 || ^9.1.0"  to ensure 
necessary permissions for transform[3].
- Re-add 3.14.2 changelog entry as it is overwritten in VPC Flow PR[4].
- Skip system tests for securityhub* data streams to avoid fleet health 
degradation due to empty template values by httpjson. This is fixed in 
8.19.4 and 9.1.4 by beats#45810[5] and beats#46332[6]. This skip can 
be removed when the stack version is upgraded to ones containing the fix. 

[1] https://www.elastic.co/guide/en/security/current/vuln-management-overview.html
[2] https://www.elastic.co/docs/solutions/security/cloud/cloud-security-posture-management
[3] elastic/elasticsearch#128350
[4] #15077
[5] elastic/beats#45810
[6] elastic/beats#46332
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-8.18 Automated backport to the 8.18 branch backport-8.19 Automated backport to the 8.19 branch backport-9.0 Automated backport to the 9.0 branch backport-9.1 Automated backport to the 9.1 branch bugfix enhancement Filebeat Filebeat Team:Security-Service Integrations Security Service Integrations Team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Filebeat] Avoid updating Fleet health status to degraded when HTTPJSON template value evaluation is empty

4 participants