Integration Name

Azure Logs [azure]

Dataset Name

events

Integration Version

1.34.1

Agent Version

8.19.7

Agent Output Type

elasticsearch

Elasticsearch Version

8.19.7

OS Version and Architecture

N/A

Software/API Version

No response

Error Message

cannot access method/field [endsWith] from a null def reference

Event Original

No response

What did you do?

Default integration config

What did you see?

Received cannot access method/field [endsWith] from a null def reference error message on Azure Logs.

What did you expect to see?

There should be a check on the set processor in the event that the field doesn't exist.

Anything else?

Suggestions to check field exists on the set processor:

ctx.routing?.category.endsWith("SignInLogs")
ctx?.routing?.category != null && ctx.routing?.category.endsWith("SignInLogs")

The set processor affected is:

 - set:
      field: event.dataset
      value: azure.signinlogs
      # Use same logic as the `signinlogs` stream that drops any document that doesn't end with `SignInLogs`.
      if: 'ctx.routing?.category.endsWith("SignInLogs")'