fix(azure): Improve error handling in ingest pipeline on_failure#17176
fix(azure): Improve error handling in ingest pipeline on_failure#17176andrewkroh merged 6 commits intoelastic:mainfrom
Conversation
44525e2 to
46a32cc
Compare
Update ingest pipeline on_failure handlers to set event.kind to pipeline_error per best practices. This change updates the 23 pipelines that were missing this processor. The graphactivitylogs and signinlogs default.yml pipelines already had it and were not modified. The error.message format was also updated to follow the guidance from https://github.com/elastic/integrations/wiki/Fleet-Package-Code-Review-Comments#pipeline-on_failure-handler-must-set-errormessage
46a32cc to
1dda33b
Compare
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
efd6
left a comment
There was a problem hiding this comment.
Do we want to set the "preserve_original_event" tag here too?
packages/azure/data_stream/firewall_logs/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
All Azure ingest pipeline on_failure handlers now append the preserve_original_event tag. This ensures the original event data is retained when pipeline processing fails, which is essential for troubleshooting and debugging issues.
When processor-level on_failure handlers catch errors, they append to error.message but processing continues without triggering the pipeline-level on_failure handler. This left documents without event.kind set to pipeline_error and without the preserve_original_event tag. Added conditional processors before pipeline-level on_failure handlers in five data streams to detect when error.message exists and properly set event.kind and preserve_original_event tag. This ensures consistent error handling whether failures occur at the processor or pipeline level. Affected data streams: auditlogs, firewall_logs, graphactivitylogs, platformlogs, springcloudlogs.
There was a problem hiding this comment.
The handler in firewall_logs/default.yml previously included a remove processor to clean up intermediate fields (json, _conf, message). This PR removes that cleanup, which would leave temporary fields in error documents. The application_gateway/default.yml file correctly preserves its equivalent remove processor - the same should be done for firewall_logs.
Why is Claude responding? | Type @claude to interact further
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
packages/azure/data_stream/firewall_logs/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
The on_failure handler previously included a remove processor to clean up intermediate fields (json, _conf, message). This processor was accidentally removed during the error handling improvements. Restore it to ensure these temporary fields are cleaned up even when pipeline failures occur.
👍 I added a section about this to https://github.com/elastic/integrations/wiki/Fleet-Package-Code-Review-Comments#pipeline-on_failure-handler-must-preserve-original-event |
There was a problem hiding this comment.
The PR correctly improves error handling across Azure ingest pipelines by:
- Adding
event.kind: pipeline_errorto all on_failure handlers - this properly classifies failed events - Adding
preserve_original_eventtag - ensures original data is retained for troubleshooting - Adding conditional checks before pipeline-level on_failure handlers in files with processor-level error handlers (auditlogs, firewall_logs, graphactivitylogs, platformlogs, springcloudlogs) - these correctly handle the case where processor-level on_failure sets error.message but processing continues
- Improving error.message format with mustache conditionals to cleanly handle optional processor tags
The implementation is consistent across all 27 modified files, and the conditional checks are appropriately placed only where needed (after processor-level handlers that set error.message, before the pipeline-level on_failure).
Why is Claude responding? | Type @claude to interact further
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
|
Requires review from @elastic/obs-infraobs-integrations. |
Bumped PR version from 1.35.2 to 1.36.1 to follow the 1.36.0 release that landed on main.
💚 Build Succeeded
History
|
|
Package azure - 1.36.1 containing this change is available at https://epr.elastic.co/package/azure/1.36.1/ |
Proposed commit message
Checklist
changelog.ymlfile.