Solved: 'panic encountered: non-string given for securityr... - Page 2

samryanturner · 02-06-2025 08:52 AM

I have the following parser code -

    # Security Result
    if [severity] == "INFO" {
        mutate {
            replace => {
                "security_result_action" => "ALLOW"
                "security_result_description" => "SUCCESS"
            }
        }
    }

However when previewing it's output I see the following error -

generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \"idm\": index 0: recursive rawDataToProto failed: field \"read_only_udm\": index 0: recursive rawDataToProto failed: field \"security_result\": index 0: recursive rawDataToProto failed: panic encountered: non-string given for backstory.SecurityResult.description: []interface {} []interface {}{\"SUCCESS\"}"

Why is this not being interpreted as a string?

dlove40

filter {    
    mutate {
        replace => {
            "event_type" => "GENERIC_EVENT"
            "severity" => "INFO"
        }
    }
 # Security Result
    if [severity] == "INFO" {

        mutate {
            replace => {
                "description" => "SUCCESS"
            }
        }
        mutate {
            replace => {
                "security_action" => "ALLOW"
                "security_result.description" => "%{description}"
            }
        }
    }
    else if [severity] == "ERROR" {
        mutate {
            replace => {
                "security_action" => "BLOCK"
                "security_result.description" => "%{jsonPayload.status.message}"
            }
        }
    }
    # Merge Action
    if [security_action] != "" {
            mutate {
                merge => {
                    "security_result.action" => "security_action"
                }
            }
    }
    # Merge Security Results
    if [security_result] != "" {
        mutate {
            merge => {
                "event.idm.read_only_udm.security_result" => "security_result"
            }
        }
    }
    # Default Event Data
    mutate {
        replace => {
            "event.idm.read_only_udm.metadata.event_type"  =>  "%{event_type}"
        }
    }
    # Generate Event
    mutate {
        merge => {
            "@output" => "event" 
        }
    }
}

View solution in original post

New SecOps Webinar May 14th! Learn about Gemini's generative AI within Google SecOps

'panic encountered: non-string given for securityresult.description'