[juniper_srx] extract IP from RPD_IFD_NOTIFICATION events by ilyannn · Pull Request #18927 · elastic/integrations

ilyannn · 2026-05-09T17:08:43Z

Summary

Add a tag-specific grok in the system pipeline to extract the interface address from RPD_IFD_NOTIFICATION messages (pattern address #N <IP>) into host.ip and related.ip.
Map juniper.srx.interface_index (the IFD/SNMP interface index) to ECS observer.ingress.interface.id, for consistency with the existing interface_name → observer.ingress.interface.name rename (interface up/down events carry no flow direction).
Drop the redundant juniper.srx.system.if_trace: the generic k-v extractor surfaces it from IF_TRACE: messages, but it just duplicates message (message minus the IF_TRACE: prefix). Also drop juniper.srx.system when the cleanup leaves it empty.
Guard the juniper.srx.message → message rename with ctx.message == null so it does not fail (rename errors on an existing target) or overwrite the message already populated from the event's free text.
Add a RPD_IFD_NOTIFICATION test case with fictional values.
Bump version to 1.28.0.

Test plan

elastic-package test pipeline -C packages/juniper_srx --data-streams log — all cases PASS.
New RPD_IFD_NOTIFICATION test event in test-system.log produces host.ip: ["175.16.199.0"], related.ip: ["175.16.199.0"], and observer.ingress.interface.id: "508".
elastic-package check -C packages/juniper_srx passes (lint + build, README regenerated).

🤖 Partially generated with Claude Code under my supervision.

Add a tag-specific grok in the system pipeline to extract the interface address from RPD_IFD_NOTIFICATION messages (pattern: "address #N <IP>") into host.ip and related.ip. Declare juniper.srx.system.if_trace and juniper.srx.interface_index fields surfaced by the message k-v extractor. Also avoid overwriting an already-populated message field when renaming juniper.srx.message. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

github-actions · 2026-05-09T17:09:53Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-05-09T17:36:54Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

Resolves conflicts in manifest.yml (keep 1.28.0) and changelog.yml (keep both 1.28.0 enhancement and 1.27.1 bugfix entries).

infra-vault-gh-plugin-prod · 2026-05-18T19:22:38Z

Pinging @elastic/integration-experience (Team:Integration-Experience)

taylor-swanson

A few comments, and merge conflicts will need to be resolved.

taylor-swanson · 2026-06-03T16:32:48Z

+        - name: if_trace
+          type: keyword


Do we really need if_trace? Could we drop the field instead? It seems to basically be the same as what's in message

Good point, I've dropped it.

taylor-swanson · 2026-06-03T16:34:56Z

+    - name: interface_index
+      type: keyword


I would prefer this to go to an ECS field, if possible, but the only two options for interface index would be (as a closest match):

observer.egress.interface.id

observer.ingress.interface.id

Two issues I see:

Is interface.id mean the same thing as interface index?

Can we determine the direction of traffic flow from this log?

Sure, it seems to be the IFD/SNMP index which matches interface.id. This seems to be an interface up/down event without a direction, but since we don't have interface.id at the root level, I've used observer.ingress.interface.id for consistency with the existing processor:

- rename: tag: rename_juniper_srx_interface_name_to_observer_ingress_interface_name_4023c7b6 field: juniper.srx.interface_name target_field: observer.ingress.interface.name ignore_missing: true

taylor-swanson · 2026-06-03T16:35:29Z

    target_field: message
    ignore_missing: true
-    if: "ctx.juniper?.srx?.message != null"
+    if: "ctx.juniper?.srx?.message != null && ctx.message == null"


Are we getting complaints about overwriting an existing message?

No, I just did not want to let juniper.srx.message field:

"message": "<Up Broadcast Multicast> agg_parent 0 address #0 175.16.199.0",

clobber the message field that is set in a different part:

"message": "IF_TRACE: EVENT <UpDown> st0.60 index 508 <Up Broadcast Multicast> agg_parent 0 address #0 175.16.199.0",

They come from two different places, one the key message and one the free text after the []:

<30>1 ... RPD_IFD_NOTIFICATION [junos@1111.1.1.1.1.111 ... message="<Up Broadcast Multicast> ..."] IF_TRACE: EVENT <UpDown> st0.60 index 508 <Up Broadcast Multicast> ...

Without the guard the rename just fails.

We can fix the rename failure (clear the message first), but since we do have juniper.srx.message field in fields.yml it looked like we might want to use that field as well. The description of that field is not very helpful:

- name: message type: keyword description: | mesagge

This field is present in test-atp.log, for example:

"juniper": { "srx": { "message": "malware analysis detected host downloaded a malicious_file with score 9, sha256 ABC123",

and we don't rename it to message there.

…peline-tweaks # Conflicts: # packages/juniper_srx/changelog.yml # packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log # packages/juniper_srx/data_stream/log/_dev/test/pipeline/test-system.log-expected.json # packages/juniper_srx/manifest.yml

…index to ECS - Drop juniper.srx.system.if_trace: the generic k-v extractor surfaces it from IF_TRACE messages but it duplicates `message` (message minus the "IF_TRACE: " prefix). Remove the field and its declaration. - Also drop juniper.srx.system when the cleanup leaves it empty. - Map juniper.srx.interface_index (SNMP/IFD index) to ECS observer.ingress.interface.id, alongside the interface name that already lands under observer.ingress for these events. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

elastic-vault-github-plugin-prod · 2026-07-05T15:14:18Z

✅ All changelog entries have the correct PR link.

vera-review-bot · 2026-07-05T15:16:31Z

No issues across the latest commits b934903, 363ff7a.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

infra-vault-gh-plugin-prod · 2026-07-05T15:37:52Z

💚 Build Succeeded

Buildkite Build
Commit: 363ff7a

History

💚 Build #45471 succeeded e56617f
💚 Build #45344 succeeded 6ee51ec
💚 Build #43026 succeeded 2253eef
💚 Build #42602 succeeded db0a75e

cc @ilyannn

ilyannn requested a review from a team as a code owner May 9, 2026 17:08

ilyannn marked this pull request as draft May 9, 2026 17:09

andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:juniper_srx Juniper SRX labels May 11, 2026

ilyannn self-assigned this May 18, 2026

Merge branch 'main' into juniper_srx-system-pipeline-tweaks

2253eef

Resolves conflicts in manifest.yml (keep 1.28.0) and changelog.yml (keep both 1.28.0 enhancement and 1.27.1 bugfix entries).

ilyannn marked this pull request as ready for review May 18, 2026 19:17

ilyannn added enhancement New feature or request Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] and removed documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. labels May 18, 2026

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label May 18, 2026

taylor-swanson reviewed Jun 3, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jun 5, 2026

[Anthropic] Claude Code / Cowork Telemetry #19407

Open

ilyannn and others added 2 commits July 1, 2026 20:06

ilyannn requested a review from taylor-swanson July 1, 2026 19:12

infra-vault-gh-plugin-prod Bot deleted a comment from elasticmachine Jul 1, 2026

andrewkroh removed the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jul 1, 2026

Merge branch 'main' into juniper_srx-system-pipeline-tweaks

e56617f

ilyannn enabled auto-merge (squash) July 3, 2026 13:41

Merge branch 'main' into juniper_srx-system-pipeline-tweaks

363ff7a

Uh oh!

Conversation

ilyannn commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

github-actions Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Elastic Docs Style Checker (Vale)

Uh oh!

elastic-vault-github-plugin-prod Bot commented May 9, 2026

🚀 Benchmarks report

Uh oh!

infra-vault-gh-plugin-prod Bot commented May 18, 2026

Uh oh!

taylor-swanson left a comment

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

ilyannn Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

ilyannn Jul 1, 2026

Choose a reason for hiding this comment

Uh oh!

taylor-swanson Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

ilyannn Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ilyannn Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

elastic-vault-github-plugin-prod Bot commented Jul 5, 2026

Uh oh!

vera-review-bot Bot commented Jul 5, 2026

Uh oh!

infra-vault-gh-plugin-prod Bot commented Jul 5, 2026

💚 Build Succeeded

History

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ilyannn commented May 9, 2026 •

edited

Loading

github-actions Bot commented May 9, 2026 •

edited

Loading

ilyannn Jul 1, 2026 •

edited

Loading

ilyannn Jul 1, 2026 •

edited

Loading