[cisco_asa] Time with fraction-of-seconds support #13059
Conversation
* Two new logs added * Date formats updated * No passing tests failed * New logs parsed successfully
🚀 Benchmarks reportTo see the full report comment with |
| previous PR: #12202 |
| - "MMM d yyyy HH:mm:ss[.SSSSSSSSS] z" | ||
| - "MMM dd yyyy HH:mm:ss[.SSSSSSSSS] z" | ||
| - "EEE MMM d yyyy HH:mm:ss[.SSSSSSSSS] z" | ||
| - "EEE MMM dd yyyy HH:mm:ss[.SSSSSSSSS] z" |
There was a problem hiding this comment.
This is getting a bit ridiculous... I think we should look at re-doing this part.
I was playing around with the pipeline simulator and came up with this:
"[EEE ]MMM [ ]d[ yyyy] HH:mm:ss[.nnn][ z]" I haven't tested all cases yet, but this does seem to catch most of them. One caveat, I truncated the fractional seconds down to three digits (millisecond precision). The date processor does this already, so I don't think this is a problem.
There was a problem hiding this comment.
I agree! I was getting some weird errors when updating, and I have to use the .SSS instead of .n, because the .n doesn't actually get output.
taylor-swanson left a comment
taylor-swanson left a comment There was a problem hiding this comment.
Okay, can confirm, I did test the following and all tests pass, except one, where event.timezone: "UTC" shows up in the results 🤷
# # Parse the date included in FTD logs # - date: if: ctx._temp_?.raw_date != null tag: parse_raw_date timezone: "{{{ event.timezone }}}" field: "_temp_.raw_date" formats: - "ISO8601" - "[EEE ]MMM [ ]d[ yyyy] HH:mm:ss[.nnnnnnnnn][.SSS][ z]" on_failure: # Try to re-parse as UTC to catch when TZ is invalid or unknown. - remove: field: event.timezone ignore_missing: true - date: if: ctx._temp_?.raw_date != null tag: "parse_raw_date_fallback" field: "_temp_.raw_date" formats: - "ISO8601" - "[EEE ]MMM [ ]d[ yyyy] HH:mm:ss[.nnnnnnnnn][.SSS][ z]"By the way, I made a slight adjustment to the fractional seconds... nanoseconds is tried first, but will only match if there's 9 digits (as expected), or it will match against the milliseconds one.
As Michael mentioned, a couple more test cases are needed (especially with fractional seconds).
andrewkroh added the Team:Security-Deployment and Devices 
| Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
taylor-swanson left a comment
taylor-swanson left a comment There was a problem hiding this comment.
Updated changes seem fine to me. My original suggestion only supported milliseconds and nanoseconds, not microseconds. I don't think there's a clever way to do all of that in one pattern.
My only last request is that we have a nanosecond test case (can literally just copy one the microsecond case and add 3 extra digits at the end to make it nanoseconds).
💚 Build Succeeded
History
|
|
| Package cisco_asa - 2.43.1 containing this change is available at https://epr.elastic.co/package/cisco_asa/2.43.1/ |
5 participants
Proposed commit message
[cisco_asa] Timestamp with fraction-of-seconds now parsed
Checklist
changelog.ymlfile.[ ] I have verified that any added dashboard complies with Kibana's Dashboard good practicesAuthor's Checklist
How to test this PR locally
Related issues
Screenshots