Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Infoblox nios wrong syslog parsing #23272

Closed
adriansr opened this issue Dec 23, 2020 · 1 comment · Fixed by #23273
Closed

Infoblox nios wrong syslog parsing #23272

adriansr opened this issue Dec 23, 2020 · 1 comment · Fixed by #23273
Assignees
@adriansr
Labels
bug Filebeat Filebeat

Comments

@adriansr
Copy link
Contributor

For confirmed bugs, please report:

  • Version: 7.9+
  • Operating System: -
  • Discuss Forum URL: -

The infoblox/nios dataset can't parse logs in the following format:

Mon Day hh:mm:ss ip service[pid]: [...]

It works if a hostname is added before the IP address:

Mon Day hh:mm:ss hostname ip service[pid]: [...]

This is due the conflicting ordering of headers in the original device parser:

https://github.com/adriansr/nwdevice2filebeat/blob/1c1d0f6610f5d0e7b859dd4c81130012a49dcafb/devices/infobloxnios/infobloxniosmsg.xml#L12-L20
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@adriansr adriansr self-assigned this Dec 23, 2020
adriansr added a commit to adriansr/beats that referenced this issue Dec 23, 2020
@adriansr
Reorder headers for infoblox module
5ac061c 
This reorders the syslog headers parsers for the infoblox/nios dataset
so that the simpler header is picked up first. Otherwise it will
fail to properly parse logs.

Fixes elastic#23272
@adriansr adriansr mentioned this issue Dec 23, 2020
Merged
2 tasks
adriansr added a commit that referenced this issue Dec 28, 2020
@adriansr
Reorder headers for infoblox module (#23273)
27d0f08 
* Reorder headers for infoblox module

This reorders the syslog headers parsers for the infoblox/nios dataset
so that the simpler header is picked up first. Otherwise it will
fail to properly parse logs.

Fixes #23272

* Changelog entry
adriansr added a commit to adriansr/beats that referenced this issue Dec 28, 2020
@adriansr
Reorder headers for infoblox module (elastic#23273)
4550e14 
* Reorder headers for infoblox module

This reorders the syslog headers parsers for the infoblox/nios dataset
so that the simpler header is picked up first. Otherwise it will
fail to properly parse logs.

Fixes elastic#23272

* Changelog entry

(cherry picked from commit 27d0f08)
@adriansr adriansr mentioned this issue Dec 28, 2020
Merged
2 tasks
adriansr added a commit that referenced this issue Dec 28, 2020
@adriansr
Reorder headers for infoblox module (#23273) (#23293)
0dc3fc6 
* Reorder headers for infoblox module

This reorders the syslog headers parsers for the infoblox/nios dataset
so that the simpler header is picked up first. Otherwise it will
fail to properly parse logs.

Fixes #23272

* Changelog entry

(cherry picked from commit 27d0f08)
adriansr added a commit to adriansr/beats that referenced this issue Dec 28, 2020
@adriansr
Reorder headers for infoblox module (elastic#23273)
a36fa7e 
* Reorder headers for infoblox module

This reorders the syslog headers parsers for the infoblox/nios dataset
so that the simpler header is picked up first. Otherwise it will
fail to properly parse logs.

Fixes elastic#23272

* Changelog entry

(cherry picked from commit 27d0f08)
@adriansr adriansr mentioned this issue Dec 28, 2020
Merged
2 tasks
adriansr added a commit that referenced this issue Dec 29, 2020
@adriansr
Reorder headers for infoblox module (#23273) (#23302)
174e37e 
* Reorder headers for infoblox module

This reorders the syslog headers parsers for the infoblox/nios dataset
so that the simpler header is picked up first. Otherwise it will
fail to properly parse logs.

Fixes #23272

* Changelog entry

(cherry picked from commit 27d0f08)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@adriansr adriansr

Labels
bug Filebeat Filebeat
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Reorder headers for infoblox module adriansr/beats
2 participants
@adriansr @elasticmachine