-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Let network processor handle multiple IPs #41918
Let network processor handle multiple IPs #41918
Conversation
Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform) |
This pull request does not have a backport label.
To fixup this pull request, you need to add the backport labels for the needed
|
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, just the one change in the changelog from processor to condition
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The documentation for the processor should be updated to indicate the behavior for arrays.
This pull request is now in conflicts. Could you fix it? 🙏
|
* let network processor handle multiple IPs * add changelog * linter... * fix linter, logs, changelog * linter... * linter... * linter... * update docs * whoops * simplify logic * docs, cleanup (cherry picked from commit 0827467)
* let network processor handle multiple IPs * add changelog * linter... * fix linter, logs, changelog * linter... * linter... * linter... * update docs * whoops * simplify logic * docs, cleanup (cherry picked from commit 0827467) Co-authored-by: Alex K. <[email protected]> Co-authored-by: fearful-symmetry <[email protected]>
Proposed commit message
This fixes a bug where the network processor would simply fail if it was given a document that had a list of IPs instead of a single IP. This uses "any match is a match" logic and instead traverses the list of IPs, if there is one.
Checklist
CHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Issue
#41917