[Filebeat] Cisco module asa-ftd pipeline pollutes the mapping when it fails #18391
Comments
botelastic
bot
added
the
needs_team
adriansr
added a commit
to adriansr/beats
that referenced
this issue
May 8, 2020
The shared pipeline for Cisco ASA and FTD creates temporary fields under the _temp_ object. If a failure happens in the middle of the pipeline, all those fields would be indexed, causing the index mapping to grow too big. Fixes elastic#18391
adriansr
added
Team:SIEM
and removed
needs_team
|
Pinging @elastic/siem (Team:SIEM) |
6 tasks
adriansr
added a commit
that referenced
this issue
May 13, 2020
The shared pipeline for Cisco ASA and FTD creates temporary fields under the _temp_ object. If a failure happens in the middle of the pipeline, all those fields would be indexed, causing the index mapping to grow too big. Fixes #18391
adriansr
added a commit
to adriansr/beats
that referenced
this issue
May 13, 2020
The shared pipeline for Cisco ASA and FTD creates temporary fields under the _temp_ object. If a failure happens in the middle of the pipeline, all those fields would be indexed, causing the index mapping to grow too big. Fixes elastic#18391 (cherry picked from commit 3605c47)
6 tasks
adriansr
added a commit
to adriansr/beats
that referenced
this issue
May 13, 2020
The shared pipeline for Cisco ASA and FTD creates temporary fields under the _temp_ object. If a failure happens in the middle of the pipeline, all those fields would be indexed, causing the index mapping to grow too big. Fixes elastic#18391 (cherry picked from commit 3605c47)
6 tasks
adriansr
added a commit
to adriansr/beats
that referenced
this issue
May 13, 2020
The shared pipeline for Cisco ASA and FTD creates temporary fields under the _temp_ object. If a failure happens in the middle of the pipeline, all those fields would be indexed, causing the index mapping to grow too big. Fixes elastic#18391 (cherry picked from commit 3605c47)
6 tasks
This was referenced May 13, 2020
leweafan
pushed a commit
to leweafan/beats
that referenced
this issue
Apr 28, 2023
…ic#18476) The shared pipeline for Cisco ASA and FTD creates temporary fields under the _temp_ object. If a failure happens in the middle of the pipeline, all those fields would be indexed, causing the index mapping to grow too big. Fixes elastic#18391 (cherry picked from commit 9c3faed)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Filebeat version: 7.4.2
The
asa-ftdingest pipeline of the cisco Filebeat module leaves a lot of_temp_.*fields in the ingested documents if the pipeline fails at the wrong processor. This means that the index mapping size grows dramatically due to the dynamic mapping mechanism and which causes problems when querying the cluster state.The text was updated successfully, but these errors were encountered: