Skip to main content

merge in parser extension overwrites the value instead of merging

  • January 18, 2024
  • 5 replies
  • 40 views

Forum|alt.badge.img

I am writing parser extension and want to update security_result.description field.

if [@computed][message] != "" {
mutate {
replace => {
"security_result.description" => "%{@computed.message}"
}
}

mutate {
merge => {
"event.idm.read_only_udm.security_result" => "security_result"
}
}

mutate {
 merge => {
 "@output" => "event"
 }
 }
}
 
end result is that all other security_results fields are deleted, I see description field only.
How can I add description field?

 

 

5 replies

vgera
Forum|alt.badge.img+1
  • Bronze 1
  • April 29, 2024

I also have the same question, can someone please provide an answer?


Forum|alt.badge.img+1
  • New Member
  • April 29, 2024

Hello,

I am also facing issue, can someone please update how can we handle this?

 


Forum|alt.badge.img+1

what other security_results fields are there in other parts of the parser? 
usually when I use security_result.* I assign a number for every single fields

 




Forum|alt.badge.img+1
  • New Member
  • April 30, 2024

what other security_results fields are there in other parts of the parser? 
usually when I use security_result.* I assign a number for every single fields

 




Other security_result fields are like security_result.category, securit_result.severity, securit_result.threat_name, securit_result.threat_status,  etc


citreno
Forum|alt.badge.img+6
  • Bronze 1
  • April 30, 2024

Bug/Known issue afaik, arrays get overriden and since security_result is an array/repeated field we just avoid putting anything in it via extension. Unfortunately this field is not really workable through parser extensions, we just avoid it. You can use a different field and file a feature request.