[island_browser] - Fix device pipeline parsing of multi-NIC internalIpAddress by ShourieG · Pull Request #20282 · elastic/integrations

ShourieG · 2026-07-22T10:31:29Z

Type of change

Bug

Proposed commit message

island_browser: fix device pipeline parsing of multi-NIC internalIpAddress

The device ingest pipeline used a single dissect on the first "/" to
extract an IP from internalIpAddress. When the Island API returned a
"/"-separated list of "<ip> | <adapter>" pairs for hosts with 3+ NICs,
the leftover separators failed the subsequent convert-to-ip and produced
event.kind: pipeline_error.

Strip the adapter labels with gsub, split the cleaned list into
individual addresses, and append each one to related.ip. The single-IP
path is unchanged. Adds multi-NIC, two-NIC, and single-NIC-with-adapter
cases to the device pipeline test.

Note

Test data was generated using LLMs, it does not contain any customer data.

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Closes [Island Browser] device ingest pipeline fails to parse internalIpAddress for devices with 3+ NICs #18159

Screenshots

…dress The device ingest pipeline used a single dissect on the first "/" to extract an IP from internalIpAddress. When the Island API returned a "/"-separated list of "<ip> | <adapter>" pairs for hosts with 3+ NICs, the leftover separators failed the subsequent convert-to-ip and produced event.kind: pipeline_error. Strip the adapter labels with gsub, split the cleaned list into individual addresses, and append each one to related.ip. The single-IP path is unchanged. Adds multi-NIC, two-NIC, and single-NIC-with-adapter cases to the device pipeline test. Fixes elastic#18159 Co-authored-by: Cursor <cursoragent@cursor.com>

infra-vault-gh-plugin-prod · 2026-07-22T10:32:53Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

github-actions · 2026-07-22T10:33:43Z

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

elastic-vault-github-plugin-prod · 2026-07-22T10:58:37Z

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

Drop the redundant if conditions on the gsub, split, and convert processors that handle internalIpAddress; each already has ignore_missing, which exits on a missing or null field. Represent a single internal IP as a scalar rather than a one-element list so single-NIC devices match the shape used when the API reports a single IP directly, while multi-NIC devices keep the array. Correct the changelog link to point at the pull request. Updates elastic#18159 Co-authored-by: Cursor <cursoragent@cursor.com>

ShourieG · 2026-07-22T13:25:28Z

@mohitjha-elastic, I've addressed all your comments.

elastic-vault-github-plugin-prod · 2026-07-22T13:29:49Z

✅ All changelog entries have the correct PR link.

vera-review-bot · 2026-07-22T13:36:02Z

No issues across the latest commits 5d0b7fd.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

ShourieG · 2026-07-22T13:43:28Z

+  - script:
+      lang: painless
+      tag: script_flatten_single_internal_ip
+      description: >-
+        Represent a single internal IP as a scalar rather than a single-element
+        list, so devices with one NIC match the shape used for devices that
+        report a single IP directly.
+      if: ctx.island_browser?.device?.internal_ip_address instanceof List && ctx.island_browser.device.internal_ip_address.size() == 1
+      source: >-
+        ctx.island_browser.device.internal_ip_address = ctx.island_browser.device.internal_ip_address.get(0);


The script is resistant against edge-case values like 192.0.2.10/ compared to a split + set that will produce a list in this case.

infra-vault-gh-plugin-prod · 2026-07-22T13:54:36Z

💚 Build Succeeded

Buildkite Build
Commit: 5d0b7fd

History

💚 Build #46452 succeeded 75fdbfe

cc @ShourieG

ShourieG · 2026-07-22T14:06:19Z

+            "island_browser": {
+                "device": {
+                    "browser_name": "Island",
+                    "email": "test.three@example.com",
+                    "external_ip_address": "203.0.113.200",
+                    "id": "device-test-multinic-3",
+                    "internal_ip": "192.0.2.10 | Ethernet0/198.51.100.20 | Wi-Fi/203.0.113.30",
+                    "internal_ip_address": [
+                        "192.0.2.10",
+                        "198.51.100.20",
+                        "203.0.113.30"
+                    ],


@mohitjha-elastic, example of convert processor working on multiple ips

elastic-vault-github-plugin-prod · 2026-07-22T14:33:01Z

Package island_browser - 1.1.2 containing this change is available at https://epr.elastic.co/package/island_browser/1.1.2/

ShourieG self-assigned this Jul 22, 2026

ShourieG added bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Integration:island_browser Island Browser labels Jul 22, 2026

updated changelog

75fdbfe

ShourieG marked this pull request as ready for review July 22, 2026 10:32

ShourieG requested review from a team as code owners July 22, 2026 10:32