citrix_adc: fix ICASTART Grok pattern for empty customername and trailing \r - #20518
citrix_adc: fix ICASTART Grok pattern for empty customername and trailing \r#20518Niceplace wants to merge 7 commits into
Conversation
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
…ling \r
The grok_sslvpn_icastart pattern failed on ICASTART events where
customername was absent (producing two consecutive spaces) and on events
with a trailing carriage return from network appliances.
- Replace `( %{WORD})?` with `(?:%{SPACE}%{WORD})?%{SPACE}` so the
separator whitespace is flexible regardless of whether customername is
present or absent.
- Replace trailing ` ?$` with `%{SPACE}$` to absorb \r and other
trailing whitespace.
Adds a regression test case matching the customer-reported log format.
87b9484 to
4fc37b7
Compare
Extends the remove_newlines gsub from stripping only \n to stripping both \r and \n so that trailing CR from network appliances does not reach sub-pipeline Grok patterns.
| Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN LOGIN 4471 0 : User JohnDoe - Client_ip 192.168.1.50 - Nat_ip 10.0.0.50 - Vserver 1.128.0.0:443 - Browser_type "Chrome" - SSLVPN_client_type NetScalerPlugin - Group(s) "IT,RemoteWorkers" | ||
| Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN LOGOUT 4471 0 : User JaneSmith - Client_ip 192.168.1.51 - Nat_ip 10.0.0.51 - Vserver 1.128.0.0:10443 - Start_time "2023-04-01T08:00:00Z" - End_time "2023-04-01T12:00:00Z" - Duration 00:00:04 - Http_resources_accessed 15 - NonHttp_services_accessed 5 - Total_TCP_connections 20 - Total_UDP_flows 10 - Total_policies_allowed 25 - Total_policies_denied 5 - Total_bytes_send 1 - Total_bytes_recv 500 - Total_compressedbytes_send 700 - Total_compressedbytes_recv 350 - Compression_ratio_send 50.00% - Compression_ratio_recv 70.00% - LogoutMethod "Timeout" - Group(s) "HR,Finance" | ||
| Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN ICASTART 4471 0 : Source 192.168.1.52:5060 - Destination 1.128.0.0:80 - SSLRelayAddress 10.0.0.52:443 - customername AcmeCorp - username:domainname someusername:example.domain.com - applicationName WebMail - startTime "2023-04-01T09:00:00Z" - connectionId 9a8b7c | ||
| Oct 6 14:03:23 <local0.info> 81.2.69.144 07/20/2026:15:59:08 GMT ns1 0-PPE-3 : default SSLVPN ICASTART 18346082 0 : Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime "07/20/2026:15:59:08 GMT" - connectionId 805bbd |
There was a problem hiding this comment.
Note: It does not seem possible to explicitly test for trailing or leading carriage return/line feeds given that these characters are stripped by elastic-package's usage of scanners which ends up triggering ScanLines. To quote from golan's docs
ScanLines is a split function for a Scanner that returns each line of text, stripped of any trailing end-of-line marker.
Because of this constraint, adding a newline/carriage return in a .log file will never get reflected in the generated *-expected.json. This is why the gsub processor was updated in https://github.com/elastic/integrations/pull/20518/changes#diff-432e39fad6ef3555d161b12b18065b691ce2661855fa805e7ad73060bd48e7b7R30 which guarantees we won't have any newlines or carriage-returns anywhere.
Niceplace
added
Integration:citrix_adc
|
✅ All changelog entries have the correct PR link. |
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
system |
6329.11 | 4504.5 | -1824.61 (-28.83%) | 💔 |
To see the full report comment with /test benchmark fullreport
💚 Build Succeeded
History
cc @Niceplace |
|
Tick the box to add this pull request to the merge queue (same as
|
2 participants
Summary
Fixes a Grok parse failure in the
grok_sslvpn_icastartprocessor within thesslvpn_and_aaatm_featurepipeline.Two scenarios caused the pattern to fail on valid ICASTART log events:
customername(double space): Whencustomernameis absent, the network appliance logscustomername -(two spaces before the dash). The previous pattern placed the optional space inside the capture group —customername( %{WORD})?— so when the group was skipped only one space was expected, causing a mismatch.\r): Network appliances sometimes append\rto log lines. The previous end-of-pattern anchor?$only handled 0–1 trailing spaces and could not absorb\r.Fix:
customername( %{WORD:...})? -→customername(?:%{SPACE}%{WORD:...})?%{SPACE}-— moves the separator whitespace outside the optional group so any number of spaces is accepted whether or not a name is present.?$→%{SPACE}$— absorbs trailing\rand multiple spaces via\s*.Test coverage
Added a regression test case to
test-citrix-waf-native.logmatching the exact customer-reported log format: ICASTART event withSSLRelayAddress, emptycustomername, and the$P1018application name suffix.Checklist
elastic-package formatandelastic-package lintclean1.18.6