Cyberarkpas XSLT: Translate \r and \t (elastic#25788) (elastic#25851)

These two special characters were translated to a space. This updates the XSLT to escape them to "\t" and "\r". (cherry picked from commit 1010b90) Co-authored-by: Adrian Serrano <[email protected]>
michalpristas · May 26, 2021 · 73ee711 · 73ee711
1 parent b332fc2
commit 73ee711
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/x-pack/filebeat/module/cyberarkpas/_meta/assets/elastic-json-v1.0.xsl b/x-pack/filebeat/module/cyberarkpas/_meta/assets/elastic-json-v1.0.xsl
@@ -127,9 +127,23 @@
       <xsl:with-param name="to" select="'\n'"/>
     </xsl:call-template>
   </xsl:variable>
+  <xsl:variable name="tmp3">
+    <xsl:call-template name="string-replace">
+      <xsl:with-param name="string" select="$tmp2"/>
+      <xsl:with-param name="from" select="'&#xd;'"/>
+      <xsl:with-param name="to" select="'\r'"/>
+    </xsl:call-template>
+  </xsl:variable>
+  <xsl:variable name="tmp4">
+    <xsl:call-template name="string-replace">
+      <xsl:with-param name="string" select="$tmp3"/>
+      <xsl:with-param name="from" select="'&#x09;'"/>
+      <xsl:with-param name="to" select="'\t'"/>
+    </xsl:call-template>
+  </xsl:variable>
   <xsl:text>&quot;</xsl:text>
   <xsl:call-template name="string-replace">
-    <xsl:with-param name="string" select="translate($tmp2,'&#9;&#xd;','  ')"/>
+    <xsl:with-param name="string" select="$tmp4"/>
     <xsl:with-param name="from" select="'&quot;'"/>
     <xsl:with-param name="to" select="'\&quot;'"/>
   </xsl:call-template>