Skip to content

pps: handle RFC 6587 octet-counting prefix and fix grok patterns #17678

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kcreddy merged 2 commits into from
Mar 6, 2026
Merged

pps: handle RFC 6587 octet-counting prefix and fix grok patterns #17678

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8e174f0
Fix octet framing in pps
kcreddy Mar 5, 2026
ddebb7a
update pr number
kcreddy Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions packages/pps/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,15 @@
# newer versions go on top
- version: "1.2.0"
changes:
- description: Handle RFC 6587 octet-counting prefix in syslog messages from newer Pleasant Password Server versions.
type: bugfix
link: https://github.com/elastic/integrations/pull/17678
- description: Fix grok alternation patterns that used character classes instead of groups.
type: bugfix
link: https://github.com/elastic/integrations/pull/17678
- description: Add tcp_options variable to TCP input for custom configuration such as RFC 6587 framing.
type: enhancement
link: https://github.com/elastic/integrations/pull/17678
- version: "1.1.0"
changes:
- description: Improved field extraction.
Expand Down
4 changes: 4 additions & 0 deletions packages/pps/data_stream/log/_dev/test/pipeline/test-log-octet-counted.log
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1>
185 <134>Jan 23 12:20:07 SRV-PPS-001 Pleasant Password Server:0.0.0.0 - Backup Restore Service - - Success - Backup Occurred - User <Backup Restore Service> backing up database to <C:\Backups\Backup>
170 <134>Jan 23 13:47:25 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test - - Error - Sign-in Failed - User <user@name.test> sign-in denied
230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1> changing the port fr 127.0.0.1 23/01 09:49:10.894
136 changes: 136 additions & 0 deletions packages/pps/data_stream/log/_dev/test/pipeline/test-log-octet-counted.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,136 @@
{
"expected": [
{
"@timestamp": "2026-01-23T09:49:10.000Z",
"client": {
"ip": "192.168.1.2"
},
"ecs": {
"version": "8.17.0"
},
"event": {
"created": "2026-01-23T09:49:10.000Z",
"kind": "event",
"original": "230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1>",
"outcome": "success",
"reason": "Syslog Settings Changed"
},
"host": {
"hostname": "SRV-PPS-001"
},
"log": {
"syslog": {
"priority": 134
}
},
"message": "User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1>",
"tags": [
"preserve_original_event"
],
"user": {
"domain": "name.test",
"email": "user@name.test",
"name": "user"
}
},
{
"@timestamp": "2026-01-23T12:20:07.000Z",
"client": {
"ip": "0.0.0.0"
},
"ecs": {
"version": "8.17.0"
},
"event": {
"created": "2026-01-23T12:20:07.000Z",
"kind": "event",
"original": "185 <134>Jan 23 12:20:07 SRV-PPS-001 Pleasant Password Server:0.0.0.0 - Backup Restore Service - - Success - Backup Occurred - User <Backup Restore Service> backing up database to <C:\\Backups\\Backup>",
"outcome": "success",
"reason": "Backup Occurred"
},
"host": {
"domain": "SRV-PPS-001"
},
"log": {
"syslog": {
"priority": 134
}
},
"message": "User <Backup Restore Service> backing up database to <C:\\Backups\\Backup>",
"pps": {
"entry": {
"path": "C:\\Backups\\Backup"
}
},
"tags": [
"preserve_original_event"
]
},
{
"@timestamp": "2026-01-23T13:47:25.000Z",
"client": {
"ip": "192.168.1.3"
},
"ecs": {
"version": "8.17.0"
},
"event": {
"created": "2026-01-23T13:47:25.000Z",
"kind": "event",
"original": "170 <134>Jan 23 13:47:25 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test - - Error - Sign-in Failed - User <user@name.test> sign-in denied",
"outcome": "failure",
"reason": "Sign-in Failed"
},
"host": {
"hostname": "SRV-PPS-001"
},
"log": {
"syslog": {
"priority": 134
}
},
"message": "User <user@name.test> sign-in denied",
"tags": [
"preserve_original_event"
],
"user": {
"domain": "name.test",
"email": "user@name.test",
"name": "user"
}
},
{
"@timestamp": "2026-01-23T09:49:10.000Z",
"client": {
"ip": "192.168.1.2"
},
"ecs": {
"version": "8.17.0"
},
"event": {
"created": "2026-01-23T09:49:10.000Z",
"kind": "event",
"original": "230 <134>Jan 23 09:49:10 SRV-PPS-001 Pleasant Password Server:192.168.1.2 - user@name.test - - Success - Syslog Settings Changed - User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1> changing the port fr 127.0.0.1 23/01 09:49:10.894",
"outcome": "success",
"reason": "Syslog Settings Changed"
},
"host": {
"hostname": "SRV-PPS-001"
},
"log": {
"syslog": {
"priority": 134
}
},
"message": "User <user@name.test> Syslogging setting updated changing the host from <localhost> to <127.0.0.1> changing the port fr 127.0.0.1 23/01 09:49:10.894",
"tags": [
"preserve_original_event"
],
"user": {
"domain": "name.test",
"email": "user@name.test",
"name": "user"
}
}
]
}
Loading