[zeek] Fix smtp Date header parsing and event.created robustness - #20903
[zeek] Fix smtp Date header parsing and event.created robustness#20903mjwolf wants to merge 1 commit into
Conversation
Expand the zeek.smtp date processor to handle a wider range of email Date header formats (RFC 5322 with/without weekday, date(1) 12h/24h, obs-zone comments like "(CET)") and drop the field silently on failure instead of failing the whole document. Adds three normalization processors before parsing: strip trailing obs-zone comment, collapse multiple spaces, and trim whitespace. Add ignore_empty_value: true to the event.created set processor across all 43 zeek data streams so that _simulate usage without a pre-existing @timestamp does not raise a missing-field error. Fixes: elastic#17332 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mjwolf
added
Integration:zeek
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
|
Changelog link mismatch — expected
Tip If expected, add the |
💔 Build Failed
Failed CI StepsHistorycc @mjwolf |
![vera-review-bot[bot]](https://avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
| changes: | ||
| - description: Parse a wider range of SMTP Date header formats; drop the field silently instead of failing the document when a header is unparseable. | ||
| type: bugfix | ||
| link: https://github.com/elastic/integrations/pull/17332 |
There was a problem hiding this comment.
Severity: 🟡 Medium confidence: high path: packages/zeek/changelog.yml:6
Changelog links a different PR number
Details
The changelog entries added on lines 6, 9 point at pull/17332 (line 6), pull/17332 (line 9), but they were added in PR #20903. They are likely leftover template placeholders or copies from another PR.
Recommendation:
Point each added changelog entry's link at this PR:
link: https://github.com/elastic/integrations/pull/20903🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
Review summaryIssues found across the latest commits 32ba8dd — 1 medium
🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
|
🚀 Benchmarks reportTo see the full report comment with |
1 participant
Proposed commit message
Expand the zeek.smtp date processor to handle a wider range of email Date header formats (RFC 5322 with/without weekday, date(1) 12h/24h, obs-zone comments like "(CET)") and drop the field silently on failure instead of failing the whole document. Adds three normalization processors before parsing: strip trailing obs-zone comment, collapse multiple spaces, and trim whitespace.
Add ignore_empty_value: true to the event.created set processor across all 43 zeek data streams so that _simulate usage without a pre-existing @timestamp does not raise a missing-field error.
Checklist
changelog.ymlfile.Related issues