format

efd6 · Oct 23, 2025 · Oct 10, 2025 · Oct 10, 2025 · Oct 10, 2025 · Oct 10, 2025
commit 62e56ec09b8a24efe2ccac5f7c12121349bbe166
@@ -7,4 +7,7 @@
 <134>Jan 23 13:47:25 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Error - Identity Not Verified - User <user@name.test> failed to verify themselves	127.0.0.1	23/01 13:47:25.593	
 <134>Jan 23 13:47:25 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Error - Sign-in Failed - User <user@name.test> sign-in denied	127.0.0.1	23/01 13:47:25.641	
 <134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Created - User <user@name.test> created entry <TOP/SECRET/PASSWORD> as a duplicate	127.0.0.1	23/01 14:05:54.404	
-<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Duplicated - User <user@name.test> duplicated entry <TOP/SECRET/PASSWORD>	127.0.0.1	23/01 14:05:54.450	
+<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Duplicated - User <user@name.test> duplicated entry <TOP/SECRET/PASSWORD>	127.0.0.1	23/01 14:05:54.450
+<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the name from <PASSWORD> to <PASSWORD2> changing the notes
+<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the name from <PASSWORD> to <PASSWORD2> changing the username from <entry_username> to <entry_username2> changing the password changing the notes changing the expiry date from <> to <2027-09-23 00:00>
+    <134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the username from <entry_username> to <entry_username2> changing the password changing the expiry date from <> to <2027-10-02 08:00>
@@ -1,4 +1,5 @@
 # newer versions go on top
+
 - version: "1.0.1"
   changes:
     - description: Remove duplicated installation instructions from the documentation.

@@ -15,15 +15,9 @@ processors:
   - grok:
       field: event.original
       patterns:
-        - '^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.hostname}\s%{DATA}:%{IP:client.ip}\s-\s%{USERNAME:user.name}@%{DATA:user.domain}\s%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{GREEDYDATA:message}'
-        - '^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.domain}\s%{DATA}:%{IP:client.ip}%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{GREEDYDATA:message}'
+        - '^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.hostname}\s%{DATA}:%{IP:client.ip}\s-\s%{USERNAME:user.name}@%{DATA:user.domain}\s%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
+        - '^<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.domain}\s%{DATA}:%{IP:client.ip}%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
         - '^%{GREEDYDATA:message}$'
-  - grok:
-      field: message
-      ignore_failure: true
-      ignore_missing: true
-      patterns:
-      - ^%{DATA:event.reason}\s-\s%{DATA:message}$
   - grok:
       field: message
       ignore_failure: true
@@ -38,19 +32,13 @@ processors:
       - created\sfolder\s<%{DATA:pps.entry.path}>$
       - comment\srequirement\s<.*>\s[from|to]\s<%{DATA:pps.entry.path}>$
       - notification\s.*>\s[from|to]\s<%{DATA:pps.entry.path}>$
+      - updated\sentry\s<%{DATA:pps.entry.path}>\schanging\sthe\sname\sfrom\s<%{DATA:pps.entry.name}>\sto\s<%{DATA:pps.entry.target.name}>
   - grok:
       field: message
       ignore_failure: true
       ignore_missing: true
       patterns:
       - \schanging\sthe\susername\sfrom\s<%{DATA:pps.entry.username}>\sto\s<%{DATA:pps.entry.target.username}>
-  - grok:
-      field: message
-      ignore_failure: true
-      ignore_missing: true
-      patterns:
-      - updated\sentry\s<%{DATA:pps.entry.path}>\schanging\sthe\sname\sfrom\s<%{DATA:pps.entry.name}>\sto\s<%{DATA:pps.entry.target.name}>
-
   # Set the Event Outcome to Lower Case to be ECS Compliant
   - lowercase:
       field: event.outcome

diff --git a/packages/pps/data_stream/log/fields/base-fields.yml b/packages/pps/data_stream/log/fields/base-fields.yml
@@ -13,21 +13,3 @@
 - name: log.source.address
   type: keyword
   description: Log source address
-- name: pps.entry.path
-  type: keyword
-  description: Password Path
-- name: pps.entry.reason
-  type: keyword
-  description: Reason the user interacted with a password
-- name: pps.entry.name
-  type: keyword
-  description: The name of an entry in the password manager
-- name: pps.entry.target.name
-  type: keyword
-  description: The new name of an entry in the password manager if it was changed
-- name: pps.entry.username
-  type: keyword
-  description: The username of an entry in the password manager
-- name: pps.entry.target.username
-  type: keyword
-  description: The new username of an entry in the password manager if it was changed
@@ -0,0 +1,18 @@
+- name: pps.entry.path
+  type: keyword
+  description: Password Path
+- name: pps.entry.reason
+  type: keyword
+  description: Reason the user interacted with a password
+- name: pps.entry.name
+  type: keyword
+  description: The name of an entry in the password manager
+- name: pps.entry.target.name
+  type: keyword
+  description: The new name of an entry in the password manager if it was changed
+- name: pps.entry.username
+  type: keyword
+  description: The username of an entry in the password manager
+- name: pps.entry.target.username
+  type: keyword
+  description: The new username of an entry in the password manager if it was changed