Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

o365: Support IPv4 enclosed in square brackets #18591

Merged
merged 1 commit into from
May 16, 2020
Merged

o365: Support IPv4 enclosed in square brackets #18591

merged 1 commit into from
May 16, 2020

Conversation

adriansr
Copy link
Contributor

@adriansr adriansr commented May 15, 2020 •
edited
Loading

The O365 Management API is generating some events that contain a ClientIP / ClientIPAddress field consisting of an IPv4 address enclosed in square brackets. This is breaking ingestion of those events as the brackets are only stripped for IPv6 addresses.

"ClientIP": "[10.11.12.13]:12345"

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Fixes #18587

@adriansr
o365: Support IPv4 enclosed in square brackets
665ee9a 
The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes elastic#18587
@adriansr adriansr added bug Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. Team:SIEM labels May 15, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels May 15, 2020
@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

Test stats 🧪

Test Results
Failed 0
Passed 2182
Skipped 382
Total 2564

andrewkroh
andrewkroh approved these changes May 15, 2020
View reviewed changes
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@adriansr adriansr merged commit eaf196d into elastic:master May 16, 2020
adriansr added a commit to adriansr/beats that referenced this pull request May 16, 2020
@adriansr
o365: Support IPv4 enclosed in square brackets (elastic#18591)
7b4f10b 
The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes elastic#18587

(cherry picked from commit eaf196d)
@adriansr adriansr mentioned this pull request May 16, 2020
Merged
6 tasks
@adriansr adriansr added v7.9.0 and removed needs_backport PR is waiting to be backported to other branches. labels May 16, 2020
adriansr added a commit to adriansr/beats that referenced this pull request May 16, 2020
@adriansr
o365: Support IPv4 enclosed in square brackets (elastic#18591)
4611a4e 
The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes elastic#18587

(cherry picked from commit eaf196d)
@adriansr adriansr mentioned this pull request May 16, 2020
Merged
6 tasks
adriansr added a commit to adriansr/beats that referenced this pull request May 16, 2020
@adriansr
o365: Support IPv4 enclosed in square brackets (elastic#18591)
1002f13 
The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes elastic#18587

(cherry picked from commit eaf196d)
@adriansr adriansr mentioned this pull request May 16, 2020
Merged
6 tasks
@adriansr adriansr deleted the fix_o365_ip_18587 branch May 16, 2020 15:04
adriansr added a commit that referenced this pull request May 18, 2020
@adriansr
Cherry-pick #18591 to 7.x: o365: Support IPv4 enclosed in square brac…
c2189b7 
…kets (#18601)

The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes #18587

(cherry picked from commit eaf196d)
adriansr added a commit that referenced this pull request May 18, 2020
@adriansr
Cherry-pick #18591 to 7.7: o365: Support IPv4 enclosed in square brac…
411845e 
…kets (#18603)

The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes #18587

(cherry picked from commit eaf196d)
adriansr added a commit that referenced this pull request May 18, 2020
@adriansr
Cherry-pick #18591 to 7.8: o365: Support IPv4 enclosed in square brac…
987bbdb 
…kets (#18602)

The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes #18587

(cherry picked from commit eaf196d)
leweafan pushed a commit to leweafan/beats that referenced this pull request Apr 28, 2023
@adriansr
Cherry-pick elastic#18591 to 7.7: o365: Support IPv4 enclosed in squa…
48fe447 
…re brackets (elastic#18603)

The O365 Management API is generating some events that contain a
`ClientIP` / `ClientIPAddress` field consisting of an IPv4 address
enclosed in square brackets. This is breaking ingestion of those events
as the brackets are only stripped for IPv6 addresses.

> "ClientIP": "[10.11.12.13]:12345"

This patch adds support for IPv4 enclosed in brackets and a few other
edge cases.

Fixes elastic#18587

(cherry picked from commit 6f35860)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees
No one assigned
Labels
bug Filebeat Filebeat v7.7.1 v7.8.0 v7.9.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Error ingesting Office 365 events due to invalid IP address field
3 participants
@adriansr @elasticmachine @andrewkroh