The activity/audit/platform logs data streams use a grok to extract IP addresses but they don't handle IPv6.
|
- grok: |
|
field: azure.activitylogs.callerIpAddress |
|
patterns: |
|
- \[%{IPORHOST:source.ip}\]:%{INT:source.port:int} |
|
- "%{IPORHOST:source.ip}:%{INT:source.port:int}" |
|
- "%{IPORHOST:source.ip}" |
|
ignore_missing: true |
|
ignore_failure: true |
I made changes to the SignInLogs to handle IPv6 so a similar solution could be used for these other data streams. #1721
{"type":"illegal_argument_exception","reason":"'2a00' is not an IP string literal."}}, dropping event!
"ipAddress":"2a00:
Although getting other drops such as
{"type":"mapper_parsing_exception","reason":"object mapping for [azure.activitylogs.identity] tried to parse field [identity] as object, but found a concrete value"}, dropping event!
The activity/audit/platform logs data streams use a grok to extract IP addresses but they don't handle IPv6.
integrations/packages/azure/data_stream/activitylogs/elasticsearch/ingest_pipeline/default.yml
Lines 39 to 46 in 917fd07
I made changes to the SignInLogs to handle IPv6 so a similar solution could be used for these other data streams. #1721