[sophos] Allow user-defined timezone override mappings#11873
[sophos] Allow user-defined timezone override mappings#11873mjwolf merged 0 commit intoelastic:mainfrom
Conversation
|
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
andrewkroh
left a comment
There was a problem hiding this comment.
Is there any precedence in other integrations for this type of time zone lookup table?
In examining the pipeline and input config, it is very difficult to understand which TZ will be used given all the different places where the time zone info can originate (add_locale process, the user configurable tz_offset, the event's timezone attribute, the event's timestamp).
There was a problem hiding this comment.
Please add this info the processor's description attribute. It's useful info to anyone reading the pipeline and by putting it into the description it will be visible in more places.
There was a problem hiding this comment.
taylor-swanson
left a comment
There was a problem hiding this comment.
I suggest we do something similar to what was done for Cisco IOS: #6356
Considering that short IDs suffer from ambiguity, it's important that we provide the option for the user to override them with their preferred time zone. I still think there's value in doing the lookup (in the event that a custom mapping isn't provided), but the custom mapping should get priority.
Thanks for pointing that out, I'll switch to use this idea of user-defined timezones or timezone maps. I think it's the better approach |
There was a problem hiding this comment.
Note: Etc zone IDs have reversed sign for some reason. So these are in fact the correct zone IDs for BST and CEST
|
I've reworked the PR to have user-defined timezone mapping options instead of the fixed lookup list it had previously |
I agree it's pretty confusing. I've added descriptions to some processors and tried to clean it up a bit to make it more clear what it's doing |
🚀 Benchmarks reportTo see the full report comment with |
packages/sophos/data_stream/xg/_dev/test/pipeline/test-sophos-xg.log
Outdated
Show resolved
Hide resolved
packages/sophos/data_stream/xg/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
💚 Build Succeeded
History
cc @mjwolf |
|
|
Package sophos - 3.10.0 containing this change is available at https://epr.elastic.co/package/sophos/3.10.0/ |
Add a user option to set time zone mappings to standard IANA time zone IDs. Sophos XG can use non-standard, potentially ambiguous, time zones which are not supported by Java timezone handling. To resolve this problem, this adds a "Timezone Map" option which users can use to map a Sophos time zone to a standard IANA time zone supported by Java.
Add a user option to set time zone mappings to standard IANA time zone IDs. Sophos XG can use non-standard, potentially ambiguous, time zones which are not supported by Java timezone handling. To resolve this problem, this adds a "Timezone Map" option which users can use to map a Sophos time zone to a standard IANA time zone supported by Java.
Proposed commit message
Add a user option to set time zone mappings to standard IANA time zone IDs.
Sophos XG can use non-standard, potentially ambiguous, time zones which are not supported by Java timezone handling. To resolve this problem, this adds a "Timezone Map" option which users can use to map a Sophos time zone to a standard IANA time zone supported by Java.
Checklist
changelog.ymlfile.I have verified that any added dashboard complies with Kibana's Dashboard good practicesRelated issues