Hello,
I'm trying to parse the 'rule instance name' from CrowdStrike logs, which are in JSON format. I've created a parser extension to extract the data, but I'm encountering the following error.
generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: pipeline failed: filter mutate (8) failed: merge failure: merge source field \"event\" must not be empty (try using replace to provide the value before calling merge)"
ParserExtention:
filter {
mutate {
gsub => ["message", "[\\r\\n\\t]*", ""]
}
mutate {
replace => {
"var_rule_instance_nam" => ""
}
}
json {
on_error => "not_json"
source => "message"
array_function => "split_columns"
}
mutate {
convert => {
"rule_instance_name" => "string"
}
on_error => "convert_error"
}
mutate {
replace => {
"var_rule_instance_name.value" => "%{rule_instance_name}"
}
on_error => "no_rule_instance_name"
}
if ![no_rule_instance_name] and [rule_instance_name]!= "" {
mutate {
replace => {
"var_rule_instance_name.key" => "rule_instance_name"
}
}
mutate {
merge => {
"security_result.detection_fields" => "var_rule_instance_name"
}
}
}
mutate {
merge => {
"@output" => "event"
}
}
}