[Azure] Add Microsoft Graph Activity Logs datastream#9314
[Azure] Add Microsoft Graph Activity Logs datastream#9314kcreddy merged 62 commits intoelastic:mainfrom
Conversation
🚀 Benchmarks reportTo see the full report comment with |
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
|
fyi @aarju - any feedback you have around dashboards, docs, mappings, etc very welcome :) |
@jamiehynds I don't have any feedback at this time, but I'm looking forward to testing out this integration and I may have some feedback after using it with some live data. |
packages/azure/data_stream/graphactivitylogs/agent/stream/azure-eventhub.yml.hbs
Outdated
Show resolved
Hide resolved
packages/azure/data_stream/graphactivitylogs/agent/stream/azure-eventhub.yml.hbs
Outdated
Show resolved
Hide resolved
packages/azure/data_stream/graphactivitylogs/agent/stream/azure-eventhub.yml.hbs
Outdated
Show resolved
Hide resolved
packages/azure/data_stream/graphactivitylogs/agent/stream/log.yml.hbs
Outdated
Show resolved
Hide resolved
.../azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/azure-shared-pipeline.yml
Outdated
Show resolved
Hide resolved
packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml
Show resolved
Hide resolved
| source: ctx.message = ctx.message.replace(params.empty_field_name, '') | ||
| params: | ||
| empty_field_name: '"":"",' | ||
| ignore_failure: true | ||
| tag: script-message-emptyfields |
There was a problem hiding this comment.
This is a surprising order of fields.
There was a problem hiding this comment.
It is. I took a base ingest pipeline template and modified for this usecase.
This processor is present in most of the package's datastreams. I wonder if its even required here. Might as well remove it.
There was a problem hiding this comment.
Removed this processor in the new commit.
packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
packages/azure/data_stream/graphactivitylogs/elasticsearch/ingest_pipeline/default.yml
Outdated
Show resolved
Hide resolved
💚 Build Succeeded
History
cc @kcreddy |
|
89.0% Coverage on New Code
0.0% Duplication on New Code|
Package azure - 1.10.0 containing this change is available at https://epr.elastic.co/search?package=azure |
@aarju This feature is now available. Please feel free to test and provide feedback. Thanks 😄 |
Proposed commit message
Checklist
changelog.ymlfile.How to test this PR locally
elastic-package build && elastic-package stack up -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test pipeline --generate -vRelated issues
Screenshots