From 5f1f6ca83d8d4f6786f1ef74931676eeea0f2b14 Mon Sep 17 00:00:00 2001
From: Jaime Soriano Pastor <jaime.soriano@elastic.co>
Date: Wed, 9 Jan 2019 13:46:33 +0100
Subject: [PATCH] Cherry-pick #9869 to 6.6: Handle IPv6 zone id in IIS filebeat
 ingest pipeline (#9933)

IIS logs can include zone ids when using IPv6, this is correctly parsed
but geoip processor doesn't accept these addresses. Create a temporary
field without the zone id to be used by geoip processor.

(cherry picked from commit d59ae8ce7ae21d84d49b92c0c9905fd1184b5c3b)
---
 CHANGELOG.next.asciidoc                         |  3 +++
 filebeat/module/iis/error/ingest/default.json   | 16 +++++++++++++++-
 filebeat/module/iis/error/test/ipv6_zone_id.log |  5 +++++
 .../error/test/ipv6_zone_id.log-expected.json   | 17 +++++++++++++++++
 4 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 filebeat/module/iis/error/test/ipv6_zone_id.log
 create mode 100644 filebeat/module/iis/error/test/ipv6_zone_id.log-expected.json

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index bbfba22f2c0a..d7881f9d1515 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -36,11 +36,14 @@ https://github.com/elastic/beats/compare/1035569addc4a3b29ffa14f8a08c27c1ace16ef
 
 *Filebeat*
 
+- Support IPv6 addresses with zone id in IIS ingest pipeline. {issue}9836[9836] {pull}9869[9869]
+
 *Heartbeat*
 
 *Journalbeat*
 
 *Metricbeat*
+
 - Fix panics in vsphere module when certain values where not returned by the API. {pull}9784[9784]
 
 *Packetbeat*
diff --git a/filebeat/module/iis/error/ingest/default.json b/filebeat/module/iis/error/ingest/default.json
index 632e31d717f0..af3c470afe7f 100644
--- a/filebeat/module/iis/error/ingest/default.json
+++ b/filebeat/module/iis/error/ingest/default.json
@@ -28,10 +28,24 @@
       "field": "iis.error.time"
     }
   }, {
-    "geoip": {
+    "grok": {
       "field": "iis.error.remote_ip",
+      "patterns": [
+        "%{NOZONEIP:iis.error.remote_ip_geoip}"
+      ],
+      "pattern_definitions": {
+         "NOZONEIP": "[^%]*"
+      }
+    }
+  }, {
+    "geoip": {
+      "field": "iis.error.remote_ip_geoip",
       "target_field": "iis.error.geoip"
     }
+  }, {
+    "remove": {
+      "field": "iis.error.remote_ip_geoip"
+    }
   }],
   "on_failure" : [{
     "set" : {
diff --git a/filebeat/module/iis/error/test/ipv6_zone_id.log b/filebeat/module/iis/error/test/ipv6_zone_id.log
new file mode 100644
index 000000000000..436e133e344f
--- /dev/null
+++ b/filebeat/module/iis/error/test/ipv6_zone_id.log
@@ -0,0 +1,5 @@
+#Software: Microsoft HTTP API 2.0
+#Version: 1.0
+#Date: 2018-12-30 13:48:36
+#Fields: date time c-ip c-port s-ip s-port cs-version cs-method cs-uri streamid sc-status s-siteid s-reason s-queuename
+2018-12-30 14:22:07 ::1%0 49958 ::1%0 80 - - - - - - Timer_ConnectionIdle -
diff --git a/filebeat/module/iis/error/test/ipv6_zone_id.log-expected.json b/filebeat/module/iis/error/test/ipv6_zone_id.log-expected.json
new file mode 100644
index 000000000000..d715f1ae24a8
--- /dev/null
+++ b/filebeat/module/iis/error/test/ipv6_zone_id.log-expected.json
@@ -0,0 +1,17 @@
+[
+    {
+        "@timestamp": "2018-12-30T14:22:07.000Z", 
+        "event.dataset": "iis.error", 
+        "fileset.module": "iis", 
+        "fileset.name": "error", 
+        "iis.error.queue_name": "-", 
+        "iis.error.reason_phrase": "Timer_ConnectionIdle", 
+        "iis.error.remote_ip": "::1%0", 
+        "iis.error.remote_port": "49958", 
+        "iis.error.server_ip": "::1%0", 
+        "iis.error.server_port": "80", 
+        "input.type": "log", 
+        "offset": 195, 
+        "prospector.type": "log"
+    }
+]
\ No newline at end of file