Error in Pipeline used within Cisco Umbrella Integration

I have found an issue with the Cisco Umbrella integration.

I observed that all the events being processed into ELK had a timestamp of when the document was ingested into ELK and not the time/date of the event from Umbrella.

Some looking found the issue with the Pipeline this integration uses.

You will note that the CSV parserver read the event date/time into a field of "cisco.umbrella._tmp.time" and then towards the end of the pipeline it does a date conversion to parse the date from the "cisco.umbrella._tmp.time" to the "@timestamp" field if the "cisco.umbrella._tmp.time" exists.

However, earlier in the pipeline there is a script function that does the following:

" = new HashMap();"

You can see this at line 241 here:

As the script overwrites _tmp to be a HashMap the time is then dropped.

I have manually addressed this by modifying the pipeline to put the time into a different field initially e.g. "cisco.umbrella.time" and then use that field in the date conversion.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.