Skip to content

[PPS]: Fix parsing for plain usernames and space-padded dates for syslog messages #17742

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ShourieG merged 3 commits into from
Mar 11, 2026
Merged

[PPS]: Fix parsing for plain usernames and space-padded dates for syslog messages #17742

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
64117b1
Fix grok pattern for handling syslog messages from Pleasant Password …
ShourieG Mar 10, 2026
d4da74e
updated changelog
ShourieG Mar 10, 2026
977a5c1
addressed Dan's comments
ShourieG Mar 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions packages/pps/changelog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.2.1"
changes:
- description: Fix parsing for plain usernames and space-padded dates for syslog messages from Pleasant Password Server.
type: bugfix
link: https://github.com/elastic/integrations/pull/17742
- version: "1.2.0"
changes:
- description: Handle RFC 6587 octet-counting prefix in syslog messages from newer Pleasant Password Server versions.
Expand Down
7 changes: 5 additions & 2 deletions packages/pps/data_stream/log/_dev/test/pipeline/test-log-octet-counted.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@
"reason": "Backup Occurred"
},
"host": {
"domain": "SRV-PPS-001"
"hostname": "SRV-PPS-001"
},
"log": {
"syslog": {
Expand All @@ -64,7 +64,10 @@
},
"tags": [
"preserve_original_event"
]
],
"user": {
"name": "Backup"
}
},
{
"@timestamp": "2026-01-23T13:47:25.000Z",
Expand Down
1 change: 1 addition & 0 deletions packages/pps/data_stream/log/_dev/test/pipeline/test-log.log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@
<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test - - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the name from <PASSWORD> to <PASSWORD2> changing the notes
<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test - - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the name from <PASSWORD> to <PASSWORD2> changing the username from <entry_username> to <entry_username2> changing the password changing the notes changing the expiry date from <> to <2027-09-23 00:00>
<134>Jan 23 14:05:54 SRV-PPS-001 Pleasant Password Server:192.168.1.3 - user@name.test - - Success - Entry Updated - User <user@name.test> updated entry <TOP/SECRET/PASSWORD> changing the username from <entry_username> to <entry_username2> changing the password changing the expiry date from <> to <2027-10-02 08:00>
<134>Feb 5 08:15:32 PPS-PROD Pleasant Password Server:172.16.0.5 - jsmith - Admins - Success - Entry Created - User <jsmith> created entry <Shared/Infrastructure/DB-Prod>
43 changes: 41 additions & 2 deletions packages/pps/data_stream/log/_dev/test/pipeline/test-log.log-expected.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@
"reason": "Backup Occurred"
},
"host": {
"domain": "SRV-PPS-001"
"hostname": "SRV-PPS-001"
},
"log": {
"syslog": {
Expand All @@ -98,7 +98,10 @@
"message": "User <Backup Restore Service> backing up database to <C:\\ProgramData\\Pleasant Solutions\\Password Server\\Backups\\Backup\t127.0.0.1\t23/01 12:20:07.802\t",
"tags": [
"preserve_original_event"
]
],
"user": {
"name": "Backup"
}
},
{
"@timestamp": "2026-01-23T12:37:37.000Z",
Expand Down Expand Up @@ -462,6 +465,42 @@
"email": "user@name.test",
"name": "user"
}
},
{
"@timestamp": "2026-02-05T08:15:32.000Z",
"client": {
"ip": "172.16.0.5"
},
"ecs": {
"version": "8.17.0"
},
"event": {
"created": "2026-02-05T08:15:32.000Z",
"kind": "event",
"original": "<134>Feb 5 08:15:32 PPS-PROD Pleasant Password Server:172.16.0.5 - jsmith - Admins - Success - Entry Created - User <jsmith> created entry <Shared/Infrastructure/DB-Prod>",
"outcome": "success",
"reason": "Entry Created"
},
"host": {
"hostname": "PPS-PROD"
},
"log": {
"syslog": {
"priority": 134
}
},
"message": "User <jsmith> created entry <Shared/Infrastructure/DB-Prod>",
"pps": {
"entry": {
"path": "Shared/Infrastructure/DB-Prod"
}
},
"tags": [
"preserve_original_event"
],
"user": {
"name": "jsmith"
}
}
]
}
3 changes: 3 additions & 0 deletions packages/pps/data_stream/log/elasticsearch/ingest_pipeline/default.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ processors:
field: event.original
patterns:
- '^(?:\d+ )?<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.hostname}\s%{DATA}:%{IP:client.ip}\s-\s%{USERNAME:user.name}@%{DATA:user.domain}\s%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
- '^(?:\d+ )?<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.hostname}\s%{DATA}:%{IP:client.ip}\s-\s%{USERNAME:user.name}\s%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
- '^(?:\d+ )?<%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:event.created}\s+%{NOTSPACE:host.domain}\s%{DATA}:%{IP:client.ip}%{DATA}(?<event.outcome>(Success)|(Error))\s-\s%{DATA:event.reason}\s-\s%{GREEDYDATA:message}'
- '^%{GREEDYDATA:message}$'
- grok:
Expand Down Expand Up @@ -64,6 +65,7 @@ processors:
target_field: "event.created"
formats:
- "MMM dd HH:mm:ss"
- "MMM d HH:mm:ss"

@efd6 efd6 Mar 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- "MMM dd HH:mm:ss"
- "MMM d HH:mm:ss"
- "MMM [dd][ d] HH:mm:ss"

timezone: "{{{event.timezone}}}"
if: ctx.event?.timezone != null && ctx.event?.created != null
on_failure:
Expand All @@ -78,6 +80,7 @@ processors:
target_field: "event.created"
formats:
- "MMM dd HH:mm:ss"
- "MMM d HH:mm:ss"

@efd6 efd6 Mar 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- "MMM dd HH:mm:ss"
- "MMM d HH:mm:ss"
- "MMM [dd][ d] HH:mm:ss"

if: ctx.event?.timezone == null && ctx.event?.created != null
on_failure:
- remove:
Expand Down
2 changes: 1 addition & 1 deletion packages/pps/manifest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
format_version: 3.0.3
name: pps
title: "Pleasant Password Server"
version: "1.2.0"
version: "1.2.1"
source:
license: "Apache-2.0"
description: "Integration for Pleasant Password Server Syslog Messages"
Expand Down