ShourieG · Mar 11, 2026 · Mar 10, 2026 · Mar 10, 2026 · Mar 11, 2026
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.2.1"
+  changes:
+    - description: Fix parsing for plain usernames and space-padded dates for syslog messages from Pleasant Password Server.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/17742
 - version: "1.2.0"
   changes:
     - description: Handle RFC 6587 octet-counting prefix in syslog messages from newer Pleasant Password Server versions.

@@ -49,7 +49,7 @@
                 "reason": "Backup Occurred"
             },
             "host": {
-                "domain": "SRV-PPS-001"
+                "hostname": "SRV-PPS-001"
             },
             "log": {
                 "syslog": {
@@ -64,7 +64,10 @@
             },
             "tags": [
                 "preserve_original_event"
-            ]
+            ],
+            "user": {
+                "name": "Backup"
+            }
         },
         {
             "@timestamp": "2026-01-23T13:47:25.000Z",

@@ -11,3 +11,4 @@
 <134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the name from <PASSWORD> to <PASSWORD2> changing the notes
 <134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the name from <PASSWORD> to <PASSWORD2> changing the username from <entry_username> to <entry_username2> changing the password changing the notes changing the expiry date from <> to <2027-09-23 00:00>
 <134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test -  - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the username from <entry_username> to <entry_username2> changing the password changing the expiry date from <> to <2027-10-02 08:00>
+<134>Feb  5 08:15:32 PPS-PROD Pleasant Password Server:172.16.0.5 - jsmith - Admins - Success - Entry Created - User <jsmith> created entry <Shared/Infrastructure/DB-Prod>
@@ -88,7 +88,7 @@
                 "reason": "Backup Occurred"
             },
             "host": {
-                "domain": "SRV-PPS-001"
+                "hostname": "SRV-PPS-001"
             },
             "log": {
                 "syslog": {
@@ -98,7 +98,10 @@
             "message": "User <Backup Restore Service> backing up database to <C:\\ProgramData\\Pleasant Solutions\\Password Server\\Backups\\Backup\t127.0.0.1\t23/01 12:20:07.802\t",
             "tags": [
                 "preserve_original_event"
-            ]
+            ],
+            "user": {
+                "name": "Backup"
+            }
         },
         {
             "@timestamp": "2026-01-23T12:37:37.000Z",
@@ -462,6 +465,42 @@
                 "email": "user@name.test",
                 "name": "user"
             }
+        },
+        {
+            "@timestamp": "2026-02-05T08:15:32.000Z",
+            "client": {
+                "ip": "172.16.0.5"
+            },
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "created": "2026-02-05T08:15:32.000Z",
+                "kind": "event",
+                "original": "<134>Feb  5 08:15:32 PPS-PROD Pleasant Password Server:172.16.0.5 - jsmith - Admins - Success - Entry Created - User <jsmith> created entry <Shared/Infrastructure/DB-Prod>",
+                "outcome": "success",
+                "reason": "Entry Created"
+            },
+            "host": {
+                "hostname": "PPS-PROD"
+            },
+            "log": {
+                "syslog": {
+                    "priority": 134
+                }
+            },
+            "message": "User <jsmith> created entry <Shared/Infrastructure/DB-Prod>",
+            "pps": {
+                "entry": {
+                    "path": "Shared/Infrastructure/DB-Prod"
+                }
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "jsmith"
+            }
         }
     ]
 }
@@ -16,6 +16,7 @@ processors:
       field: event.original
       patterns:
         - '^(?:\d+ )?<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.hostname}\s%{DATA}:%{IP:client.ip}\s-\s%{USERNAME:user.name}@%{DATA:user.domain}\s%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
+        - '^(?:\d+ )?<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.hostname}\s%{DATA}:%{IP:client.ip}\s-\s%{USERNAME:user.name}\s%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
         - '^(?:\d+ )?<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.domain}\s%{DATA}:%{IP:client.ip}%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
         - '^%{GREEDYDATA:message}$'
   - grok:
@@ -63,7 +64,7 @@ processors:
       field: event.created
       target_field: "event.created"
       formats:
-        - "MMM dd HH:mm:ss"
+        - "MMM [dd][ d] HH:mm:ss"
       timezone: "{{{event.timezone}}}"
       if: ctx.event?.timezone != null && ctx.event?.created != null
       on_failure:
@@ -77,7 +78,7 @@ processors:
       field: event.created
       target_field: "event.created"
       formats:
-        - "MMM dd HH:mm:ss"
+        - "MMM [dd][ d] HH:mm:ss"
       if: ctx.event?.timezone == null && ctx.event?.created != null
       on_failure:
         - remove:

@@ -1,7 +1,7 @@
 format_version: 3.0.3
 name: pps
 title: "Pleasant Password Server"
-version: "1.2.0"
+version: "1.2.1"
 source:
   license: "Apache-2.0"
 description: "Integration for Pleasant Password Server Syslog Messages"