Skip to content

Commit c39bda1

Browse files
marc-grmarc-gr
committed
Add checks to avoid empty strings
1 parent 5f6afdc commit c39bda1

File tree

32 files changed

+55
-76
lines changed

32 files changed

+55
-76
lines changed

‎filebeat/module/osquery/result/ingest/pipeline.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -211,7 +211,7 @@
211211
"append": {
212212
"field": "related.hosts",
213213
"value": "{{host.hostname}}",
214-
"if": "ctx?.host?.hostname != null",
214+
"if": "ctx?.host?.hostname != null && ctx.host?.hostname != ''",
215215
"allow_duplicates": false
216216
}
217217
}

‎filebeat/module/system/auth/ingest/pipeline.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -145,7 +145,7 @@ processors:
145145
- append:
146146
field: related.hosts
147147
value: "{{host.hostname}}"
148-
if: "ctx.host?.hostname != null"
148+
if: "ctx.host?.hostname != null && ctx.host?.hostname != ''"
149149
allow_duplicates: false
150150
on_failure:
151151
- set:

‎filebeat/module/system/syslog/ingest/pipeline.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ processors:
5757
- append:
5858
field: related.hosts
5959
value: "{{host.hostname}}"
60-
if: "ctx.host?.hostname != null"
60+
if: "ctx.host?.hostname != null && ctx.host?.hostname != ''"
6161
allow_duplicates: false
6262
on_failure:
6363
- set:

‎x-pack/filebeat/module/barracuda/spamfirewall/ingest/pipeline.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,12 @@ processors:
5656
- append:
5757
field: related.hosts
5858
value: '{{url.domain}}'
59-
if: ctx?.url?.domain != null
59+
if: ctx?.url?.domain != null && ctx?.url?.domain != ""
6060
allow_duplicates: false
6161
- append:
6262
field: related.hosts
6363
value: '{{server.domain}}'
64-
if: ctx?.server?.domain != null
64+
if: ctx?.server?.domain != null && ctx?.url?.domain != ""
6565
allow_duplicates: false
6666
on_failure:
6767
- append:

‎x-pack/filebeat/module/barracuda/spamfirewall/test/generated.log-expected.json‎

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -346,9 +346,6 @@
346346
"observer.product": "Spam",
347347
"observer.type": "Anti-Virus",
348348
"observer.vendor": "Barracuda",
349-
"related.hosts": [
350-
""
351-
],
352349
"related.ip": [
353350
"10.206.159.177"
354351
],
@@ -1148,9 +1145,6 @@
11481145
"observer.product": "Spam",
11491146
"observer.type": "Anti-Virus",
11501147
"observer.vendor": "Barracuda",
1151-
"related.hosts": [
1152-
""
1153-
],
11541148
"related.ip": [
11551149
"10.153.108.27"
11561150
],
@@ -1626,9 +1620,6 @@
16261620
"observer.product": "Spam",
16271621
"observer.type": "Anti-Virus",
16281622
"observer.vendor": "Barracuda",
1629-
"related.hosts": [
1630-
""
1631-
],
16321623
"related.ip": [
16331624
"10.153.152.219"
16341625
],
@@ -1833,9 +1824,6 @@
18331824
"observer.product": "Spam",
18341825
"observer.type": "Anti-Virus",
18351826
"observer.vendor": "Barracuda",
1836-
"related.hosts": [
1837-
""
1838-
],
18391827
"related.ip": [
18401828
"10.103.69.44"
18411829
],
@@ -1919,9 +1907,6 @@
19191907
"observer.product": "Spam",
19201908
"observer.type": "Anti-Virus",
19211909
"observer.vendor": "Barracuda",
1922-
"related.hosts": [
1923-
""
1924-
],
19251910
"related.ip": [
19261911
"10.145.193.93"
19271912
],
@@ -2034,9 +2019,6 @@
20342019
"observer.product": "Spam",
20352020
"observer.type": "Anti-Virus",
20362021
"observer.vendor": "Barracuda",
2037-
"related.hosts": [
2038-
""
2039-
],
20402022
"related.ip": [
20412023
"10.141.225.182"
20422024
],
@@ -2718,9 +2700,6 @@
27182700
"observer.product": "Spam",
27192701
"observer.type": "Anti-Virus",
27202702
"observer.vendor": "Barracuda",
2721-
"related.hosts": [
2722-
""
2723-
],
27242703
"related.ip": [
27252704
"10.157.196.101"
27262705
],
@@ -3176,8 +3155,8 @@
31763155
"observer.type": "Anti-Virus",
31773156
"observer.vendor": "Barracuda",
31783157
"related.ip": [
3179-
"10.178.30.158",
3180-
"10.1.6.115"
3158+
"10.1.6.115",
3159+
"10.178.30.158"
31813160
],
31823161
"rsa.internal.messageid": "outbound/smtp",
31833162
"rsa.investigations.event_cat": 1901000000,

‎x-pack/filebeat/module/bluecoat/director/ingest/pipeline.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ processors:
5757
field: related.hosts
5858
value: '{{host.name}}'
5959
allow_duplicates: false
60-
if: ctx?.host?.name != null
60+
if: ctx?.host?.name != null && ctx.host?.name != ''
6161
on_failure:
6262
- append:
6363
field: error.message

‎x-pack/filebeat/module/cisco/meraki/ingest/pipeline.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ processors:
6161
- append:
6262
field: related.hosts
6363
value: '{{host.hostname}}'
64-
if: ctx.host?.hostname != null
64+
if: ctx.host?.hostname != null && ctx.host?.hostname != ''
6565
allow_duplicates: false
6666
on_failure:
6767
- append:

‎x-pack/filebeat/module/cisco/nexus/ingest/pipeline.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,12 +56,12 @@ processors:
5656
- append:
5757
field: related.hosts
5858
value: '{{host.name}}'
59-
if: ctx.host?.name != null
59+
if: ctx.host?.name != null && ctx.host?.name != ''
6060
allow_duplicates: false
6161
- append:
6262
field: related.hosts
6363
value: '{{host.hostname}}'
64-
if: ctx.host?.hostname != null
64+
if: ctx.host?.hostname != null && ctx.host?.hostname != ''
6565
allow_duplicates: false
6666
on_failure:
6767
- append:

‎x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1550,22 +1550,22 @@ processors:
15501550
- append:
15511551
field: related.hosts
15521552
value: "{{host.hostname}}"
1553-
if: ctx.host?.hostname != null
1553+
if: ctx.host?.hostname != null && ctx.host?.hostname != ''
15541554
allow_duplicates: false
15551555
- append:
15561556
field: related.hosts
15571557
value: "{{observer.hostname}}"
1558-
if: ctx.observer?.hostname != null
1558+
if: ctx.observer?.hostname != null && ctx.observer?.hostname != ''
15591559
allow_duplicates: false
15601560
- append:
15611561
field: related.hosts
15621562
value: "{{destination.domain}}"
1563-
if: ctx.destination?.domain != null
1563+
if: ctx.destination?.domain != null && ctx.destination?.domain != ''
15641564
allow_duplicates: false
15651565
- append:
15661566
field: related.hosts
15671567
value: "{{source.domain}}"
1568-
if: ctx.source?.domain != null
1568+
if: ctx.source?.domain != null && ctx.source?.domain != ''
15691569
allow_duplicates: false
15701570
on_failure:
15711571
# Copy any fields under _temp_.cisco to its final destination. Those can help

‎x-pack/filebeat/module/citrix/netscaler/ingest/pipeline.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ processors:
5757
field: related.hosts
5858
value: '{{server.domain}}'
5959
allow_duplicates: false
60-
if: ctx?.server?.domain != null
60+
if: ctx?.server?.domain != null && ctx.server?.domain != ''
6161
on_failure:
6262
- append:
6363
field: error.message

0 commit comments

Comments
 (0)