[qnap_nas]: Add support for access logs with user.domain and event lo…

…gs without any associated user and ip address (elastic#17408) - Add support for access logs with user.domain and event logs without any associated user and ip address --------- Co-authored-by: Maximilian Pohle <maximilian.pohle@sva.de>
narph · Feb 23, 2026 · Feb 23, 2026 · Feb 23, 2026 · Feb 23, 2026 · Feb 23, 2026
commit 2ff4e48b8f7ee272565c001b2daf44cd8caa0410
diff --git a/packages/qnap_nas/changelog.yml b/packages/qnap_nas/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.25.2"
+  changes:
+    - description: Add support for access logs with user.domain and event logs without any associated user and ip address.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/17408
 - version: "1.25.1"
   changes:
     - description: Update documentation.

diff --git a/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log b/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log
@@ -7,4 +7,5 @@
 <30>Oct 30 20:24:30 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/New folder -> path/to/files/asdf, Action: Rename
 <30>Oct 30 20:24:33 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/asdf, Action: Delete
 <30>Oct 30 20:43:19 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/picture.jpg, Action: Read
-<30>Oct 30 20:43:19 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/picture.jpg, Action: Add
+<30>Oct 30 20:43:19 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/picture.jpg, Action: Add
+<28>Jan 29 08:47:53 qnap-nas01 qulogd[15278]: conn log: Users: domain\admin.user, Source IP: 10.50.36.33, Computer name: ---, Connection type: HTTPS, Accessed resources: Administration, Action: Login Fail
diff --git a/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log-expected.json b/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-access.log-expected.json
@@ -1,7 +1,7 @@
 {
     "expected": [
         {
-            "@timestamp": "2025-10-30T20:24:24.000-05:00",
+            "@timestamp": "2026-10-30T20:24:24.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -10,7 +10,7 @@
                 "category": [
                     "file"
                 ],
-                "created": "2025-10-30T20:24:24.000-05:00",
+                "created": "2026-10-30T20:24:24.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:24:24 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/New folder, Action: Create Directory",
                 "provider": "conn-log",
@@ -71,7 +71,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:24:25.000-05:00",
+            "@timestamp": "2026-10-30T20:24:25.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -80,7 +80,7 @@
                 "category": [
                     "authentication"
                 ],
-                "created": "2025-10-30T20:24:25.000-05:00",
+                "created": "2026-10-30T20:24:25.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:24:25 qnap-nas01 qulogd[14629]: conn log: Users: guest, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: ---, Action: Login Fail",
                 "outcome": "failure",
@@ -136,7 +136,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:35:25.000-05:00",
+            "@timestamp": "2026-10-30T20:35:25.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -145,7 +145,7 @@
                 "category": [
                     "authentication"
                 ],
-                "created": "2025-10-30T20:35:25.000-05:00",
+                "created": "2026-10-30T20:35:25.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:35:25 qnap-nas01 qulogd[14629]: conn log: Users: guest, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: ---, Action: Login Success",
                 "outcome": "success",
@@ -201,7 +201,7 @@
             }
         },
         {
-            "@timestamp": "2025-11-21T14:42:18.000-05:00",
+            "@timestamp": "2026-11-21T14:42:18.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -210,7 +210,7 @@
                 "category": [
                     "authentication"
                 ],
-                "created": "2025-11-21T14:42:18.000-05:00",
+                "created": "2026-11-21T14:42:18.000-05:00",
                 "kind": "event",
                 "original": "<30>Nov 21 14:42:18 qnap-nas01 qulogd[14387]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: ---, Connection type: HTTP/HTTPS, Accessed resources: Administration, Action: Login Success",
                 "outcome": "success",
@@ -263,7 +263,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:35:25.000-05:00",
+            "@timestamp": "2026-10-30T20:35:25.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -272,7 +272,7 @@
                 "category": [
                     "authentication"
                 ],
-                "created": "2025-10-30T20:35:25.000-05:00",
+                "created": "2026-10-30T20:35:25.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:35:25 qnap-nas01 qulogd[14629]: conn log: Users: guest, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: HTTP/HTTPS, Accessed resources: ---, Action: Logout",
                 "provider": "conn-log",
@@ -327,7 +327,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:24:30.000-05:00",
+            "@timestamp": "2026-10-30T20:24:30.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -336,7 +336,7 @@
                 "category": [
                     "file"
                 ],
-                "created": "2025-10-30T20:24:30.000-05:00",
+                "created": "2026-10-30T20:24:30.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:24:30 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: ---, Connection type: HTTP/HTTPS, Accessed resources: [File Station] /Browser Station/admin, Action: Read",
                 "provider": "conn-log",
@@ -394,7 +394,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:24:30.000-05:00",
+            "@timestamp": "2026-10-30T20:24:30.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -403,7 +403,7 @@
                 "category": [
                     "file"
                 ],
-                "created": "2025-10-30T20:24:30.000-05:00",
+                "created": "2026-10-30T20:24:30.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:24:30 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/New folder -> path/to/files/asdf, Action: Rename",
                 "provider": "conn-log",
@@ -459,7 +459,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:24:33.000-05:00",
+            "@timestamp": "2026-10-30T20:24:33.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -468,7 +468,7 @@
                 "category": [
                     "file"
                 ],
-                "created": "2025-10-30T20:24:33.000-05:00",
+                "created": "2026-10-30T20:24:33.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:24:33 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/asdf, Action: Delete",
                 "provider": "conn-log",
@@ -529,7 +529,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:43:19.000-05:00",
+            "@timestamp": "2026-10-30T20:43:19.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -538,7 +538,7 @@
                 "category": [
                     "file"
                 ],
-                "created": "2025-10-30T20:43:19.000-05:00",
+                "created": "2026-10-30T20:43:19.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:43:19 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/picture.jpg, Action: Read",
                 "provider": "conn-log",
@@ -600,7 +600,7 @@
             }
         },
         {
-            "@timestamp": "2025-10-30T20:43:19.000-05:00",
+            "@timestamp": "2026-10-30T20:43:19.000-05:00",
             "ecs": {
                 "version": "8.17.0"
             },
@@ -609,7 +609,7 @@
                 "category": [
                     "file"
                 ],
-                "created": "2025-10-30T20:43:19.000-05:00",
+                "created": "2026-10-30T20:43:19.000-05:00",
                 "kind": "event",
                 "original": "<30>Oct 30 20:43:19 qnap-nas01 qulogd[14629]: conn log: Users: admin.user, Source IP: 10.50.36.33, Computer name: user-laptop, Connection type: Samba, Accessed resources: path/to/files/picture.jpg, Action: Add",
                 "provider": "conn-log",
@@ -669,6 +669,69 @@
             "user": {
                 "name": "admin.user"
             }
+        },
+        {
+            "@timestamp": "2026-01-29T08:47:53.000-05:00",
+            "ecs": {
+                "version": "8.17.0"
+            },
+            "event": {
+                "action": "login-fail",
+                "category": [
+                    "authentication"
+                ],
+                "created": "2026-01-29T08:47:53.000-05:00",
+                "kind": "event",
+                "original": "<28>Jan 29 08:47:53 qnap-nas01 qulogd[15278]: conn log: Users: domain\\admin.user, Source IP: 10.50.36.33, Computer name: ---, Connection type: HTTPS, Accessed resources: Administration, Action: Login Fail",
+                "outcome": "failure",
+                "provider": "conn-log",
+                "timezone": "-05:00",
+                "type": [
+                    "info"
+                ]
+            },
+            "host": {
+                "name": "qnap-nas01"
+            },
+            "log": {
+                "syslog": {
+                    "priority": 28
+                }
+            },
+            "observer": {
+                "product": "NAS",
+                "type": "nas",
+                "vendor": "QNAP"
+            },
+            "process": {
+                "name": "qulogd",
+                "pid": 15278
+            },
+            "qnap": {
+                "nas": {
+                    "application": "Administration",
+                    "connection_type": "HTTPS"
+                }
+            },
+            "related": {
+                "ip": [
+                    "10.50.36.33"
+                ],
+                "user": [
+                    "admin.user"
+                ]
+            },
+            "source": {
+                "address": "10.50.36.33",
+                "ip": "10.50.36.33"
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "domain": "domain",
+                "name": "admin.user"
+            }
         }
     ]
 }
diff --git a/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log b/packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log
@@ -10,4 +10,9 @@
 <30>Nov 21 15:23:42 qnap-nas01 qulogd[14387]: event log: Users: admin.user, Source IP: 10.50.36.33, Computer name: ---, Application: Users, Category: General, Content: [Users] Changed the password of user "test".
 <30>Nov 21 15:23:42 qnap-nas01 qulogd[14387]: event log: Users: admin.user, Source IP: 10.50.36.33, Computer name: ---, Application: Users, Category: General, Content: [Users] Edited the account profile of user "test".
 <30>Nov 21 15:23:42 qnap-nas01 qulogd[14387]: event log: Users: admin.user, Source IP: 10.50.36.33, Computer name: ---, Application: Users, Category: General, Content: [Users] Created user "test".
-<30>Nov 21 15:23:42 qnap-nas01 qulogd[14387]: event log: Users: admin.user, Source IP: 10.50.36.33, Computer name: ---, Application: Users, Category: General, Content: [Users] Deleted user "test".
+<30>Nov 21 15:23:42 qnap-nas01 qulogd[14387]: event log: Users: admin.user, Source IP: 10.50.36.33, Computer name: ---, Application: Users, Category: General, Content: [Users] Deleted user "test".
+<30>Jan 30 06:00:08 qnap-nas01 qulogd[15278]: event log: Users: ---, Source IP: ---, Computer name: ---, Application: Storage & Snapshots, Category: Snapshot, Content: [Storage & Snapshots] Finished creating scheduled snapshot. Volume: Smb.
+<30>Jan 30 06:00:05 qnap-nas01 qulogd[15278]: event log: Users: ---, Source IP: ---, Computer name: ---, Application: Storage & Snapshots, Category: Snapshot, Content: [Storage & Snapshots] Reached volume/LUN snapshot limit. Volume: Smb. The oldest snapshot will be deleted whenever a new snapshot is created.
+<30>Jan 30 06:00:04 qnap-nas01 qulogd[15278]: event log: Users: ---, Source IP: ---, Computer name: ---, Application: Storage & Snapshots, Category: Snapshot, Content: [Storage & Snapshots] Deleted snapshot "GMT+01_2026-01-02_0600". Volume: Smb.
+<28>Jan 30 05:10:48 qnap-nas01 qulogd[15278]: event log: Users: ---, Source IP: ---, Computer name: ---, Application: General Settings, Category: Date & Time, Content: [General Settings] Failed to synchronize time with the NTP server "ntp1.xyz.st.xye.de".
+<30>Jan 29 23:02:27 qnap-nas01 qulogd[15278]: event log: Users: ---, Source IP: ---, Computer name: ---, Application: Storage & Snapshots, Category: RAID Group, Content: [Storage & Snapshots] Finished scrubbing RAID group "1". Storage pool: 1, Blocks repaired: 0.