[np]*: ensure event.kind is correctly set for pipeline errors

packages/netscout/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "0.16.0"
+  changes:
+    - description: Ensure event.kind is correctly set for pipeline errors.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/6662
 - version: "0.15.0"
   changes:
     - description: Update package to ECS 8.8.0.

packages/netscout/data_stream/sightline/elasticsearch/ingest_pipeline/default.yml

@@ -63,6 +63,9 @@ processors:
       ignore_failure: true
       ignore_missing: true
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: "{{ _ingest.on_failure_message }}"
+      value: '{{{ _ingest.on_failure_message }}}'

packages/netscout/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 2.7.0
 name: netscout
 title: Arbor Peakflow SP Logs
-version: "0.15.0"
+version: "0.16.0"
 description: Collect and parse logs from Netscout Arbor Peakflow SP with Elastic Agent.
 categories: ["security", "network"]
 type: integration

packages/netskope/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.9.0"
+  changes:
+    - description: Ensure event.kind is correctly set for pipeline errors.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/6662
 - version: "1.8.0"
   changes:
     - description: Update package to ECS 8.8.0.

packages/netskope/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml

@@ -1348,6 +1348,9 @@ processors:
       ignore_failure: true
       ignore_missing: true
 on_failure:
-- append:
-    field: error.message
-    value: '{{{ _ingest.on_failure_message }}}'
+  - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
+      field: error.message
+      value: '{{{ _ingest.on_failure_message }}}'

packages/netskope/data_stream/events/elasticsearch/ingest_pipeline/default.yml

@@ -1088,6 +1088,9 @@ processors:
       ignore_failure: true
       ignore_missing: true
 on_failure:
-- append:
-    field: error.message
-    value: '{{{ _ingest.on_failure_message }}}'
+  - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
+      field: error.message
+      value: '{{{ _ingest.on_failure_message }}}'

packages/netskope/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: netskope
 title: "Netskope"
-version: "1.8.0"
+version: "1.9.0"
 license: basic
 description: Collect logs from Netskope with Elastic Agent.
 type: integration

packages/panw/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "3.12.0"
+  changes:
+    - description: Ensure event.kind is correctly set for pipeline errors.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/6662
 - version: "3.11.0"
   changes:
     - description: Split panw.panos.url_category_list field in threat logs

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/authentication.yml

@@ -95,6 +95,9 @@ processors:
       copy_from: _temp_.user_agent
       ignore_failure: true
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/config.yml

@@ -92,6 +92,9 @@ processors:
       value: unknown
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/correlated_event.yml

@@ -51,6 +51,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/decryption.yml

@@ -318,6 +318,9 @@ processors:
         ctx.tls.version_protocol = ctx._temp_?.tls.substring(0,3).toLowerCase();
         ctx.tls.version = ctx._temp_?.tls.substring(3,6);
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/default.yml

@@ -1662,6 +1662,9 @@ processors:
         dropEmptyFields(ctx);
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: 'error.message'
       value: '{{{ _ingest.on_failure_message }}} {{{ _ingest.on_failure_processor_type }}}'

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/globalprotect.yml

@@ -133,6 +133,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/gtp.yml

@@ -175,6 +175,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/hipmatch.yml

@@ -75,6 +75,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/ip_tag.yml

@@ -50,6 +50,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/sctp.yml

@@ -141,6 +141,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/system.yml

@@ -50,6 +50,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/threat.yml

@@ -348,6 +348,9 @@ processors:
       separator: ","
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/traffic.yml

@@ -321,6 +321,9 @@ processors:
       on_failure: [{'append': {'field': 'error.message', 'value': '{{{ _ingest.on_failure_message }}}'}}]
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/tunnel_inspection.yml

@@ -218,6 +218,9 @@ processors:
       ignore_failure: true
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/data_stream/panos/elasticsearch/ingest_pipeline/userid.yml

@@ -90,6 +90,9 @@ processors:
       on_failure: [{'append': {'field': 'error.message', 'value': '{{{ _ingest.on_failure_message }}}'}}]
 
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
       value: >-

packages/panw/manifest.yml

@@ -1,6 +1,6 @@
 name: panw
 title: Palo Alto Next-Gen Firewall
-version: "3.11.0"
+version: "3.12.0"
 release: ga
 description: Collect logs from Palo Alto next-gen firewalls with Elastic Agent.
 type: integration

packages/panw_cortex_xdr/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.12.0"
+  changes:
+    - description: Ensure event.kind is correctly set for pipeline errors.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/6662
 - version: "1.11.0"
   changes:
     - description: Update package to ECS 8.8.0.

packages/panw_cortex_xdr/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml

@@ -560,5 +560,8 @@ processors:
       ignore_missing: true
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
-      value: "{{ _ingest.on_failure_message }}"
+      value: '{{{ _ingest.on_failure_message }}}'

packages/panw_cortex_xdr/manifest.yml

@@ -1,6 +1,6 @@
 name: panw_cortex_xdr
 title: Palo Alto Cortex XDR
-version: "1.11.0"
+version: "1.12.0"
 release: ga
 description: Collect logs from Palo Alto Cortex XDR with Elastic Agent.
 type: integration

packages/pfsense/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.9.0"
+  changes:
+    - description: Ensure event.kind is correctly set for pipeline errors.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/6662
 - version: "1.8.0"
   changes:
     - description: Update package to ECS 8.8.0.

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -227,6 +227,9 @@ on_failure:
       field:
         - _tmp
       ignore_failure: true
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/dhcp.yml

@@ -88,6 +88,9 @@ processors:
       allow_duplicates: false
       if: "ctx.pfsense?.log?.dhcp?.hostname != null"
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/firewall.yml

@@ -81,6 +81,9 @@ processors:
             - UNIX
             - UNIX_MS
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/haproxy.yml

@@ -99,5 +99,8 @@ processors:
       ignore_missing: true
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/ipsec.yml

@@ -32,6 +32,9 @@ processors:
       field: network.protocol
       value: ipsec
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/openvpn.yml

@@ -41,6 +41,9 @@ processors:
       field: network.protocol
       value: openvpn
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/php-fpm.yml

@@ -38,6 +38,9 @@ processors:
       target_field: host.name
       ignore_missing: true
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/squid.yml

@@ -27,5 +27,8 @@ processors:
       if: "ctx.http?.response?.status_code != null && ctx.http.response.status_code >= 400"
 on_failure:
   - set:
+      field: event.kind
+      value: pipeline_error
+  - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/data_stream/log/elasticsearch/ingest_pipeline/unbound.yml

@@ -52,6 +52,9 @@ processors:
       copy_from: source
       ignore_empty_value: true
 on_failure:
+  - set:
+      field: event.kind
+      value: pipeline_error
   - append:
       field: error.message
-      value: '{{ _ingest.on_failure_message }}'
+      value: '{{{ _ingest.on_failure_message }}}'

packages/pfsense/manifest.yml

@@ -1,6 +1,6 @@
 name: pfsense
 title: pfSense
-version: "1.8.0"
+version: "1.9.0"
 release: ga
 description: Collect logs from pfSense and OPNsense with Elastic Agent.
 type: integration