[dgunter]

Why

Local coverage was 95% (Sonar 94.3%, branch 89.2%). Almost every gap was in ecs.py: coercion helper branches the fixtures never hit, negative branches of the per-log post-processors, and mapping shapes the published field table does not contain.

What

• Tests: table-driven cases for _as_int / _as_float / _as_bool / _as_str / _as_ip / _append / _parse_dn; edge cases for the DNS, HTTP, SSL, Kerberos, files, SMB, SOCKS, SIP, MySQL, SSH and x509 post-processors; _common_post when no Community ID can be computed; _add_constants network defaults; ecs_index_body with a scalar-that-is-a-parent, a flattened field with a child, and a nested field; CSV to a file; an OSError during an elk run; header-only logs, re-iteration and borrowed streams in the reader.
• Code: ecs_index_body now skips children of flattened fields (Elasticsearch cannot map them; the published table has none, so the generated mapping is unchanged, and the integration test that creates it still passes). An unreachable branch in unflatten is gone. The unused ZeekLog.field_types property is removed.
• Config: the if __name__ == "__main__" guard is excluded from coverage via exclude_also; parsezeeklogs/__main__.py is excluded from Sonar coverage since only a subprocess test exercises it.

Result

	before	after
Local line + branch	95%	100%
Uncovered lines / conditions	36 / 46	0 / 0

Unit (183), integration and corpus (275) suites pass locally against Elasticsearch 9.5.3.

🤖 Generated with Claude Code

[github-actions]

SonarCloud analysis · PR #13

Quality gate: ✅ Passed · Open in SonarCloud

Condition	Actual	Required	Status
Reliability rating (new code)	A	≤ A	✅
Security rating (new code)	A	≤ A	✅
Maintainability rating (new code)	A	≤ A	✅
Coverage (new code)	100.0%	≥ 80.0%	✅
Duplication (new code)	0.0%	≤ 3.0%	✅
Security hotspots reviewed	100.0%	≥ 100.0%	✅

Open issues on new code: 1

Severity	Quality	Location	Message	Rule
MEDIUM	Maintainability	tests/test_ecs_branches.py:19	Unify assertion argument order in this file; both "actual first" and "expected first" conventions are used.	python:S3415

Machine-readable issue list

[
 {
  "key": "AaBzhJfFIGO5oxXgAtV9",
  "severity": "MEDIUM",
  "qualities": [
   "Maintainability"
  ],
  "path": "tests/test_ecs_branches.py",
  "line": 19,
  "message": "Unify assertion argument order in this file; both \"actual first\" and \"expected first\" conventions are used.",
  "rule": "python:S3415",
  "effort": "2min"
 }
]

Commit bc15706e83ac · analysis task · posted by the Build workflow; edited in place on every push.