Enrich Fleet Integration

Elastic Stack Elasticsearch
1

Hi,
I'm using Elastic Fleet to integrate with Azure Event Hub and import logs.
One of the log fields is a URL.
I want to create a new short URL filed that extracts the URL until the first question mark.
URL: www.website.com?user=1234
URLShort: www.website.com

I thought of achieving this by editing the integration and add a Processor, but I don't think it can be done this way.

I have tried editing the Ingest Pipeline but it didn't work.
Any ideas how can I achieve this?

2

What have you tried and which ingest pipeline you used? This is exactly the way to do it.

You need to create a custom ingest pipeline named logs-azure.eventhub@custom and put your processors there.

3

Thanks for the response.
I have tried editing the existing ingest - logs-azure.eventhub-1.9.2
And added a step to create the new field.
I didn't see any error but nothing happened so I'm not sure how to debug why nothing is happening.

4

I created the ingest pipeline custom as you suggested, as I see the managed pipeline is calling the custom at the last step.
I added a script task with a simple script:
ctx.azure.eventhub.properties.requestUriShort = ctx.azure.eventhub.properties.requestUri.split('?')[0]
And added the new field to the data view.
But I get an empty string and not the result I was hoping for, and I don't know how to debug why nothing is happening

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.