Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

robester0403
Copy link
Contributor

@robester0403 robester0403 commented Aug 15, 2025

Proposed commit message

iptables: Added an optional space to grok patterns as to process vyos logs properly without operator error.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
    - [] I have verified that Kibana version constraints are current according to guidelines.
    - [ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

Run and observe the new pipeline test to see expected corrected results.

Related Issues

Closes #10881

@robester0403 robester0403 force-pushed the bug/iptables-vyos-logs-errors branch from 6ef3a27 to 648e7a4 Compare August 15, 2025 11:53
@robester0403 robester0403 changed the title FIX: added optional space to process logs [iptables] added optional space to process vyos logs Aug 15, 2025
@robester0403 robester0403 marked this pull request as ready for review August 15, 2025 12:12
@robester0403 robester0403 requested a review from a team as a code owner August 15, 2025 12:12
@robester0403 robester0403 added enhancement New feature or request Integration:iptables Iptables Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] bugfix Pull request that fixes a bug issue and removed enhancement New feature or request labels Aug 15, 2025
@elastic-vault-github-plugin-prod

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

- '%{IPTABLES_ACTION}%{GREEDYDATA}%{IPTABLES}%{SPACE}'
- '%{IPTABLES_HOSTNAME}%{SPACE}%{UDM_LOGS}%{IPTABLES_IP_PAYLOAD}'
- '%{GREEDYDATA}\[%{UBIQUITI_LABEL}\]%{IPTABLES}%{SPACE}'
- '%{GREEDYDATA}\[%{UBIQUITI_LABEL}\](%{SPACE})?%{IPTABLES}%{SPACE}'
Copy link
Member

@andrewkroh andrewkroh Aug 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the trailing %{SPACE}? Is that necessary? The pattern is not anchored with $ so IIUC it will effectively ignore trailing space at the end. It's not covered by the test case either.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Regarding the trailing space at the end of these patterns, I think it's not necessary. I tested it and it made no difference to the expected logs & current test cases. I will remove it from the patterns.

@elasticmachine
Copy link

💚 Build Succeeded

History

Copy link

Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@robester0403 robester0403 self-assigned this Aug 20, 2025
@robester0403 robester0403 merged commit 27da4fa into elastic:main Aug 20, 2025
9 checks passed
@elastic-vault-github-plugin-prod

Package iptables - 1.21.3 containing this change is available at https://epr.elastic.co/package/iptables/1.21.3/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bugfix Pull request that fixes a bug issue Integration:iptables Iptables Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[iptables]: not properly parsing VyOS logs
3 participants