#13797 - CI Failure on Redact processor (#14777)

CI was failing to install the package because of the license restrictions of the Elastic Stack * Changed the redact into gsub and did a replace on the sensitive information

Author: qcorporation

packages/hpe_aruba_cx/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.1.2"
+ changes:
+ - description: Fix for licensing and the redact processor
+ type: bugfix
+ link: https://github.com/elastic/integrations/pull/14777
 - version: "0.1.1"
  changes:
  - description: Changed owners.

packages/hpe_aruba_cx/data_stream/log/_dev/test/pipeline/test-aruba-cx.log-expected.json

@@ -4833,7 +4833,7 @@
  "aruba": {
  "aaa": {
  "tacacs_action": "update",
- "tacacs_event": " -> redact>",
+ "tacacs_event": " -> ****",
  "tacacs_type": "global default tacacs_passkey"
  },
  "component": {
@@ -4857,7 +4857,7 @@
  "kind": [
  "event"
  ],
- "original": "2024-06-19T14:21:13.194235-05:00 8360-Primaire aaautilscfgd[712]: Event|2302|LOG_INFO|AMM|1/1|TACACS global default tacacs_passkey update: -> redact>",
+ "original": "2024-06-19T14:21:13.194235-05:00 8360-Primaire aaautilscfgd[712]: Event|2302|LOG_INFO|AMM|1/1|TACACS global default tacacs_passkey update : -> ****",
  "outcome": "unknown",
  "sequence": 1,
  "type": [
@@ -4871,7 +4871,7 @@
  "procid": "712"
  }
  },
- "message": "TACACS global default tacacs_passkey update: -> redact>",
+ "message": "TACACS global default tacacs_passkey update : -> ****",
  "tags": [
  "preserve_original_event"
  ]

packages/hpe_aruba_cx/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -8,13 +8,13 @@ processors:
  - remove:
  field: message
  ignore_missing: true
- - redact:
+ - gsub:
  field: "event.original"
  tag: redact_passkey
  description: "Redacting passkey updates"
- prefix: "tacacs_passkey update: -> "
- patterns:
-  - "tacacs_passkey %{GREEDYDATA:redact}"
+ replacement: "$1****"
+ pattern: "(tacacs_passkey update : -> )([^\\s]+)$"
+ ignore_missing: true
  - set:
  field: ecs.version
  value: "8.11.0"
@@ -1209,7 +1209,7 @@ processors:
  field: "message"
  description: "Logs TACACS+ server update, server group update and global default update"
  patterns:
- - "^TACACS %{GREEDYDATA:aruba.aaa.tacacs_type} %{DATA:aruba.aaa.tacacs_action}:\\s?%{GREEDYDATA:aruba.aaa.tacacs_event}"
+ - "^TACACS %{GREEDYDATA:aruba.aaa.tacacs_type} %{DATA:aruba.aaa.tacacs_action} :\\s?%{GREEDYDATA:aruba.aaa.tacacs_event}"
  - grok:
  if: "ctx.event.code == '2303'"
  tag: aaa_event_2303

packages/hpe_aruba_cx/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.2.1
 name: hpe_aruba_cx
 title: "HPE Aruba CX"
-version: 0.1.1
+version: 0.1.2
 description: "Collect logs from HPE Aruba CX with Elastic Agent"
 type: integration
 categories: