Skip to content

[iptables] added optional space to process vyos logs #14948

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

robester0403
Copy link
Contributor

@robester0403 robester0403 commented Aug 15, 2025

Proposed commit message

iptables: Added an optional space to grok patterns as to process vyos logs properly without operator error.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
    - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Run and observe the new pipeline test to see expected corrected results.

Related Issues

Closes #10881

@robester0403 robester0403 force-pushed the bug/iptables-vyos-logs-errors branch from 6ef3a27 to 648e7a4 Compare August 15, 2025 11:53
@robester0403 robester0403 changed the title FIX: added optional space to process logs [iptables] added optional space to process vyos logs Aug 15, 2025
@robester0403 robester0403 marked this pull request as ready for review August 15, 2025 12:12
@robester0403 robester0403 requested a review from a team as a code owner August 15, 2025 12:12
@robester0403 robester0403 added enhancement New feature or request Integration:iptables Iptables Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] bugfix Pull request that fixes a bug issue and removed enhancement New feature or request labels Aug 15, 2025
@elastic-vault-github-plugin-prod

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@@ -57,7 +57,7 @@ processors:
- '%{IPTABLES_HOSTNAME}%{GREEDYDATA}\[%{UBIQUITI_LABEL}\]%{IPTABLES}%{SPACE}'
- '%{IPTABLES_ACTION}%{GREEDYDATA}%{IPTABLES}%{SPACE}'
- '%{IPTABLES_HOSTNAME}%{SPACE}%{UDM_LOGS}%{IPTABLES_IP_PAYLOAD}'
- '%{GREEDYDATA}\[%{UBIQUITI_LABEL}\]%{IPTABLES}%{SPACE}'
- '%{GREEDYDATA}\[%{UBIQUITI_LABEL}\](%{SPACE})?%{IPTABLES}%{SPACE}'
Copy link
Member

@andrewkroh andrewkroh Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the trailing %{SPACE}? Is that necessary? The pattern is not anchored with $ so IIUC it will effectively ignore trailing space at the end. It's not covered by the test case either.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding the trailing space at the end of these patterns, I think it's not necessary. I tested it and it made no difference to the expected logs & current test cases. I will remove it from the patterns.

@elasticmachine
Copy link

💚 Build Succeeded

History

Copy link

Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bugfix Pull request that fixes a bug issue Integration:iptables Iptables Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[iptables]: not properly parsing VyOS logs
3 participants