IIS parser: support IPv6 addresses with a zone index - #5188
Open
Sanjays2402 wants to merge 1 commit into
Open
Conversation
The Windows IIS text plugin matched the s-ip and c-ip fields with pyparsing_common.ipv6_address, which does not accept the zone index suffix of a scoped literal IPv6 address (for example fe80::1ff:fe23:4567:890a%3). Such log lines produced an "unable to parse log line" extraction warning and were not extracted. _IP_ADDRESS now accepts an optional "%<zone>" suffix after an IPv6 address and returns the full scoped address. IPv4, unscoped IPv6 and the blank "-" value are unchanged. Added testIPAddressWithZoneIndex to the plugin tests.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #5188 +/- ##
==========================================
- Coverage 85.10% 85.09% -0.01%
==========================================
Files 456 456
Lines 41089 41090 +1
==========================================
- Hits 34967 34965 -2
- Misses 6122 6125 +3 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Member
|
Thanks for the proposed changes, do you have example log lines that can be added as test data? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
One line description of pull request
IIS parser: support IPv6 addresses with a zone index.
Description:
The IIS text plugin matched the
s-ipandc-ipfields withpyparsing_common.ipv6_address, which does not accept the zone index suffix of ascoped literal IPv6 address (e.g.
fe80::1ff:fe23:4567:890a%3), so those loglines produced an "unable to parse log line" extraction warning and were dropped.
_IP_ADDRESSnow accepts an optional%<zone>suffix after an IPv6 address andreturns the full scoped address. IPv4, unscoped IPv6 and the blank
-value areunchanged.
testIPAddressWithZoneIndexcovers all four forms and fails withoutthe parser change.
Related issue (if applicable): fixes #4903
Notes:
This change was prepared with AI assistance; the regression test was run locally
and fails without the fix.
Checklist: