Skip to content

Commit 2429e1f

Browse files
kcreddykcreddy
authored
pps: handle RFC 6587 octet-counting prefix and fix grok patterns (#17678)
Newer versions of Pleasant Password Server prepend an RFC 6587 octet count (e.g. "230 ") to syslog messages sent over TCP. The ingest pipeline's grok patterns anchored to "^<" and rejected these messages, causing all fields to fall through to the catch-all pattern. Add an optional "\d+ " prefix to the two structured grok patterns so they handle both formats without configuration changes. Also fix three secondary grok patterns that used character classes ([created|updated], [from|to]) instead of alternation groups ((?:created|updated), (?:from|to)). These matched by accident because the first character of each word was in the class, but would not match the intended words correctly. Expose a tcp_options variable on the TCP input so users can set framing, max_message_size, or other TCP-level options if needed.
1 parent 60fd836 commit 2429e1f

7 files changed

Lines changed: 198 additions & 44 deletions

File tree

‎packages/pps/changelog.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,15 @@
11
# newer versions go on top
2+
- version: "1.2.0"
3+
changes:
4+
- description: Handle RFC 6587 octet-counting prefix in syslog messages from newer Pleasant Password Server versions.
5+
type: bugfix
6+
link: https://github.com/elastic/integrations/pull/17678
7+
- description: Fix grok alternation patterns that used character classes instead of groups.
8+
type: bugfix
9+
link: https://github.com/elastic/integrations/pull/17678
10+
- description: Add tcp_options variable to TCP input for custom configuration such as RFC 6587 framing.
11+
type: enhancement
12+
link: https://github.com/elastic/integrations/pull/17678
213
- version: "1.1.0"
314
changes:
415
- description: Improved field extraction.

‎packages/pps/data_stream/log/_dev/test/pipeline/test-log-octet-counted.log‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1>
2+
185 <134>Jan 23 12:20:07 SRV-PPS-001 Pleasant Password Server:0.0.0.0 - Backup Restore Service - - Success - Backup Occurred - User <Backup Restore Service> backing up database to <C:\Backups\Backup>
3+
170 <134>Jan 23 13:47:25 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test - - Error - Sign-in Failed - User <user@name.test> sign-in denied
4+
230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1> changing the port fr 127.0.0.1 23/01 09:49:10.894

‎packages/pps/data_stream/log/_dev/test/pipeline/test-log-octet-counted.log-expected.json‎

Lines changed: 136 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2026-01-23T09:49:10.000Z",
5+
"client": {
6+
"ip": "192.168.1.2"
7+
},
8+
"ecs": {
9+
"version": "8.17.0"
10+
},
11+
"event": {
12+
"created": "2026-01-23T09:49:10.000Z",
13+
"kind": "event",
14+
"original": "230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1>",
15+
"outcome": "success",
16+
"reason": "Syslog Settings Changed"
17+
},
18+
"host": {
19+
"hostname": "SRV-PPS-001"
20+
},
21+
"log": {
22+
"syslog": {
23+
"priority": 134
24+
}
25+
},
26+
"message": "User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1>",
27+
"tags": [
28+
"preserve_original_event"
29+
],
30+
"user": {
31+
"domain": "name.test",
32+
"email": "user@name.test",
33+
"name": "user"
34+
}
35+
},
36+
{
37+
"@timestamp": "2026-01-23T12:20:07.000Z",
38+
"client": {
39+
"ip": "0.0.0.0"
40+
},
41+
"ecs": {
42+
"version": "8.17.0"
43+
},
44+
"event": {
45+
"created": "2026-01-23T12:20:07.000Z",
46+
"kind": "event",
47+
"original": "185 <134>Jan 23 12:20:07 SRV-PPS-001 Pleasant Password Server:0.0.0.0 - Backup Restore Service - - Success - Backup Occurred - User <Backup Restore Service> backing up database to <C:\\Backups\\Backup>",
48+
"outcome": "success",
49+
"reason": "Backup Occurred"
50+
},
51+
"host": {
52+
"domain": "SRV-PPS-001"
53+
},
54+
"log": {
55+
"syslog": {
56+
"priority": 134
57+
}
58+
},
59+
"message": "User <Backup Restore Service> backing up database to <C:\\Backups\\Backup>",
60+
"pps": {
61+
"entry": {
62+
"path": "C:\\Backups\\Backup"
63+
}
64+
},
65+
"tags": [
66+
"preserve_original_event"
67+
]
68+
},
69+
{
70+
"@timestamp": "2026-01-23T13:47:25.000Z",
71+
"client": {
72+
"ip": "192.168.1.3"
73+
},
74+
"ecs": {
75+
"version": "8.17.0"
76+
},
77+
"event": {
78+
"created": "2026-01-23T13:47:25.000Z",
79+
"kind": "event",
80+
"original": "170 <134>Jan 23 13:47:25 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test - - Error - Sign-in Failed - User <user@name.test> sign-in denied",
81+
"outcome": "failure",
82+
"reason": "Sign-in Failed"
83+
},
84+
"host": {
85+
"hostname": "SRV-PPS-001"
86+
},
87+
"log": {
88+
"syslog": {
89+
"priority": 134
90+
}
91+
},
92+
"message": "User <user@name.test> sign-in denied",
93+
"tags": [
94+
"preserve_original_event"
95+
],
96+
"user": {
97+
"domain": "name.test",
98+
"email": "user@name.test",
99+
"name": "user"
100+
}
101+
},
102+
{
103+
"@timestamp": "2026-01-23T09:49:10.000Z",
104+
"client": {
105+
"ip": "192.168.1.2"
106+
},
107+
"ecs": {
108+
"version": "8.17.0"
109+
},
110+
"event": {
111+
"created": "2026-01-23T09:49:10.000Z",
112+
"kind": "event",
113+
"original": "230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1> changing the port fr 127.0.0.1 23/01 09:49:10.894",
114+
"outcome": "success",
115+
"reason": "Syslog Settings Changed"
116+
},
117+
"host": {
118+
"hostname": "SRV-PPS-001"
119+
},
120+
"log": {
121+
"syslog": {
122+
"priority": 134
123+
}
124+
},
125+
"message": "User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1> changing the port fr 127.0.0.1 23/01 09:49:10.894",
126+
"tags": [
127+
"preserve_original_event"
128+
],
129+
"user": {
130+
"domain": "name.test",
131+
"email": "user@name.test",
132+
"name": "user"
133+
}
134+
}
135+
]
136+
}

0 commit comments

Comments
 (0)