# Grok error in official Azure integration
**URL:** https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [May 16, 2023, 3:24pm UTC](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585 "2023-05-16T15:24:30Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@nemhods](https://discuss.elastic.co/u/nemhods)
#### Post date: [May 16, 2023, 3:24pm UTC](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585/1 "2023-05-16T15:24:30Z")
Hey,
the Azure integration currently (I'm using 8.7.0) fails to ingest some Azure Activity Logs with IPv6 source addresses. The reason is this [processor](https://github.com/elastic/beats/blob/main/x-pack/filebeat/module/azure/activitylogs/ingest/pipeline.yml#L39):
```auto
- grok:
field: azure.activitylogs.callerIpAddress
patterns:
- \[%{IPORHOST:source.ip}\]:%{INT:source.port:int}
- "%{IPORHOST:source.ip}:%{INT:source.port:int}"
- "%{IPORHOST:source.ip}"
ignore_missing: true
ignore_failure: true
```
Given a CallerIPAddress of `2001:0db8:85a3:0000:0000:8a2e:0370:7334`, the second GROK pattern will match, yielding:
```auto
{
"source": {
"port": 0,
"ip": "2001"
}
}
```
This document fails to ingest because `'2001' is not an IP string literal.`
I solved it by changing the order of the patterns and checking for the plain `%{IPORHOST:source.ip}` first.
Am I getting this right? Should I open a bug report on github?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [May 17, 2023, 12:02am UTC](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585/2 "2023-05-17T00:02:42Z")
> [@nemhods](#):
>
> Should I open a bug report on github?
Yes please! ๐
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [May 17, 2023, 12:47pm UTC](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585/3 "2023-05-17T12:47:41Z")
As every developer say, it's not a bug, it's a feature ๐
---
### Author:  [@nemhods](https://discuss.elastic.co/u/nemhods)
#### Post date: [May 17, 2023, 6:22pm UTC](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585/4 "2023-05-17T18:22:24Z")
I found a pull request with extensive discussion - it's not as simple as it seems! Also, fleet may install slightly different pipelines than the latest Filebeat. TIL.
>
>
> @zmoog: Draft PR for #34277. Will add test cases soon.
>
> \- Enhancement
>
> \## Whโฆat does this PR do?
>
> Adds support for parsing IPv6 addresses in the filebeat Azure activitylogs, auditlogs, and platformlogs ingest pipelines.
>
> \## Why is it important?
>
> Currently any logs from these Azure log source which have an IPv6 address as the source are not ingested into elasticsearch because the ingest pipeline throws an error when attempting to ingest these logs.
>
> \## Checklist
>
> \- \[x\] My code follows the style guidelines of this project
> ~~- \[\] I have commented my code, particularly in hard-to-understand areas~~
> \- \[\] I have made corresponding changes to the documentation
> ~~- \[\] I have made corresponding change to the default configuration files~~
> \- \[\] I have added tests that prove my fix is effective or that my feature works
> \- \[\] I have added an entry in \`CHANGELOG.next.asciidoc\` or \`CHANGELOG-developer.next.asciidoc\`.
>
> \## How to test this PR locally
>
> No easy test yet, test cases still need to be added
>
> \## Related issues
>
> \- Closes #34277
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2023, 8:23pm UTC](https://discuss.elastic.co/t/grok-error-in-official-azure-integration/333585/5 "2023-06-14T20:23:10Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.