-
Notifications
You must be signed in to change notification settings - Fork 518
Open
Labels
Category: Integration qualityCategory: Quality used for SI planningCategory: Quality used for SI planningIntegration:crowdstrikeCrowdStrikeCrowdStrikeTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]Team:Sit-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]
Description
logfile input is deprecated and disabled in favor of filestream input.
#12503 added allow_deprecated_use: true flag to all logfile input templates to continue allowing the logfile input, but crowdstrike.fdr data stream was missed in this change.
Without this flag, the ingestion still happens because the original deprecation isn't valid for Elastic Agent based integrations. But to make crowdstrike.fdr data stream consistent with other logfile based input templates, we need to add this flag to stream.yml.hbs. This also allows that the ingestion isn't temporarily broken if deprecation is made valid for Elastic Agent integrations.
This issue is only valid until logfile to filestream migration is done: #16141
Metadata
Metadata
Assignees
Labels
Category: Integration qualityCategory: Quality used for SI planningCategory: Quality used for SI planningIntegration:crowdstrikeCrowdStrikeCrowdStrikeTeam:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]Security Service Integrations team [elastic/security-service-integrations]Team:Sit-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Crest developers on the Security Integrations team [elastic/sit-crest-contractors]