Yes, it defines an optional type in CEL, an underlying filebeat input used to ingest the data.
It looks that the v4.0.0 of Qualys VMDR integration is broken as when enabling Host Detection we are getting the following error:
Did this error occur when you were upgrading from a previous version of the integration? If so, what was the previous version of the integration?
The optional type is also introduced in v8.12.0 Elastic Stack. Can you also confirm the version of Elastic Agent you currently setup for the integration?
Elastic Agent version can be found by navigating to Management -> Fleet -> Agents and check Version.
We upgraded the agent to 8.13.4 and the integration works only partially.
for Host detection we get logs but sometimes it fails with error.message:
[
failed eval: ERROR: <input>:12:19: no such key: HOST_LIST_VM_DETECTION_OUTPUT
| }).do_request().as(resp, resp.Body.as(xml, bytes(xml).decode_xml('qualys_api_2_0').as(body, {
| ..................^,
Processor json with tag json_message in pipeline logs-qualys_vmdr.asset_host_detection-4.0.0 failed with message: field [message] not present as part of path [message]
]
For user activity it fails for each request with:
[
failed eval: ERROR: <input>:14:21: csv: record on line 2: wrong number of fields
| }).do_request().as(resp,
| ....................^,
Processor 'conditional' with tag 'fail_on_cel_error' failed with message 'CEL program returned an error. Skipping ingest pipeline execution.'
]
There were few bug fixes and improvements in recent Qualys integration version 4.1.1. Can you confirm if you are able to fix above issues by upgrading to latest version?
If not, it would be nice to have the sanitized API response by removing sensitive data. You can do so with Enable request tracing integration option. This captures the API request/responses to Elastic Agent's logs folder.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.