Skip to content

Incorrect data types in Fleet managed ingest pipelines #85486

@andrewkroh

Description

@andrewkroh

Kibana version:

{
  "version": {
    "number": "7.11.0",
    "build_hash": "1a6d7308e58787bf0448f65c039739b40d4a6e3d",
    "build_number": 37074,
    "build_snapshot": true
  }
}

Elasticsearch version:

{
  "version": {
    "number": "7.11.0-SNAPSHOT",
    "build_flavor": "default",
    "build_type": "docker",
    "build_hash": "279bf21e59fcbac1135922b4828f82578f266234",
    "build_date": "2020-12-08T15:51:24.143094Z"
  }
}

Server OS version: Docker

Browser version: Firefox 83.0

Browser OS version: MacOS

Original install method (e.g. download page, yum, from source, etc.): Docker

Describe the bug:

Steps to reproduce:

  1. Setup Fleet.
  2. Install Palo Alto integration.
  3. View the ingest node pipeline with
    GET _ingest/pipeline/logs-panw.panos-*
  4. Find the script processor with several params.

Screen Shot 2020-12-09 at 5 21 42 PM

5. Compare those `params` values to the definition contained in the package definition. Note the JSON contains strings, but the pipeline source contains numbers. You can download the package from the package registry `curl -L -O https://epr.elastic.co/epr/panw/panw-0.3.2.zip`. The pipeline is in default.yml.

Screen Shot 2020-12-09 at 5 25 28 PM

Expected behavior:
The ingest node pipeline in Elasticsearch should contain numeric values for params. My assumption is that there's an issue with the YAML to JSON conversion, but I'm not sure. What I expect to see is this conversion output (where JSON has numbers).

Screen Shot 2020-12-09 at 7 13 35 PM

Any additional context:

In this instance the incorrect data types cause problems within the Painless script. But this could cause problems elsewhere too. The error we see from this pipeline is

Cannot convert [java.lang.String] to an integral value.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:FleetFleet team's agent central management projectTeam:FleetTeam label for Observability Data Collection Fleet teambugFixes for quality problems that affect the customer experience

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions