citrix_adc: fix ICASTART Grok pattern for empty customername and trailing \r

packages/citrix_adc/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.18.6"
+  changes:
+    - description: Fix ICASTART Grok pattern to handle empty customername (double space) and trailing carriage return characters.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20518
 - version: "1.18.5"
   changes:
     - description: Fix parsing of Source/Destination IP, port, and byte counts for TCP CONN_TERMINATE events with trailing whitespace.

packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-native.json

@@ -85,8 +85,8 @@
             "message": "<134> 11/18/2024:10:59:53 GMT HOSTNAME 0-PPE-2 : default SSLVPN LOGOUT 6918043 0 : User UserName@domain.com - Client_ip 0.0.0.0 - Nat_ip \"Mapped Ip\" - Vserver 0.0.0.0:443 - Start_time \"11/18/2024:10:59:53 GMT\" - End_time \"11/18/2024:10:59:53 GMT\" - Duration 00:00:00 - Http_resources_accessed 0 - NonHttp_services_accessed 0 - Total_TCP_connections 0 - Total_UDP_flows 0 - Total_policies_allowed 0 - Total_policies_denied 0 - Total_bytes_send 0 - Total_bytes_recv 0 - Total_compressedbytes_send 0 - Total_compressedbytes_recv 0 - Compression_ratio_send 0.00% - Compression_ratio_recv 0.00% - LogoutMethod \"InternalError\" - Group(s) \"N/A\"\n"
         },
         {
-            "@timestamp": "02/13/2025:19:47:20.000Z", 
-        "message": "<135> 02/13/2025:19:47:20 GMT ECLVNSGP001 0-PPE-1 : default SSLVPN Message 877558 0 : \"\nclnt npcb is 12007a600, srvr is 12008be80\""
+            "@timestamp": "02/13/2025:19:47:20.000Z",
+            "message": "<135> 02/13/2025:19:47:20 GMT ECLVNSGP001 0-PPE-1 : default SSLVPN Message 877558 0 : \"\nclnt npcb is 12007a600, srvr is 12008be80\""
         }
     ]
 }

packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-rfc5424.json

@@ -9,7 +9,7 @@
             "message": "<173>1 2025-01-30T12:00:00Z MY-CITRIX-HOST newsyslog 79382 - - logfile turned over due to size>100K"
         },
         {
-            "@timestamp": "2025-01-08T13:30:00Z" ,
+            "@timestamp": "2025-01-08T13:30:00Z",
             "message": "<171>1 2025-01-08T13:30:00Z MY-CITRIX-HOST httpd::authz_core 38137 - - [client 175.16.199.1:36664] AH01630: client denied by server configuration: /netscaler/ns_gui/var "
         },
         {

packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log

@@ -24,6 +24,7 @@ Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : U
 Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN LOGIN 4471 0 : User JohnDoe - Client_ip 192.168.1.50 - Nat_ip 10.0.0.50 - Vserver 1.128.0.0:443 - Browser_type "Chrome" - SSLVPN_client_type NetScalerPlugin - Group(s) "IT,RemoteWorkers"
 Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN LOGOUT 4471 0 : User JaneSmith - Client_ip 192.168.1.51 - Nat_ip 10.0.0.51 - Vserver 1.128.0.0:10443 - Start_time "2023-04-01T08:00:00Z" - End_time "2023-04-01T12:00:00Z" - Duration 00:00:04 - Http_resources_accessed 15 - NonHttp_services_accessed 5 - Total_TCP_connections 20 - Total_UDP_flows 10 - Total_policies_allowed 25 - Total_policies_denied 5 - Total_bytes_send 1 - Total_bytes_recv 500 - Total_compressedbytes_send 700 - Total_compressedbytes_recv 350 - Compression_ratio_send 50.00% - Compression_ratio_recv 70.00% - LogoutMethod "Timeout" - Group(s) "HR,Finance"
 Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN ICASTART 4471 0 : Source 192.168.1.52:5060 - Destination 1.128.0.0:80 - SSLRelayAddress 10.0.0.52:443 - customername AcmeCorp - username:domainname someusername:example.domain.com - applicationName WebMail - startTime "2023-04-01T09:00:00Z" - connectionId 9a8b7c
+Oct 6 14:03:23 <local0.info> 81.2.69.144 07/20/2026:15:59:08 GMT ns1 0-PPE-3 : default SSLVPN ICASTART 18346082 0 : Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername  - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime "07/20/2026:15:59:08 GMT" - connectionId 805bbd
 Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN ICAEND_CONNSTAT 4471 0 : Source 192.168.1.53:22 - Destination 1.128.0.0:443 - SSLRelayAddress 10.0.0.53:443 - customername BetaInc - username:domainname someusername:example.domain.com - startTime "2023-04-01T09:00:00Z" - endTime "2023-04-01T09:45:00Z" - Duration 00:01:04 - Total_bytes_send 500000 - Total_bytes_recv 250000 - Total_compressedbytes_send 350000 - Total_compressedbytes_recv 175000 - Compression_ratio_send 50.00% - Compression_ratio_recv 70.00% - connectionId 1a2b3c
 Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN TCPCONNSTAT 4471 0 : User AliceCooper - Client_ip 192.168.1.54 - Nat_ip 10.0.0.54 - Vserver 1.128.0.0:20443 - Source 192.168.1.55:443 - Destination 1.128.0.0:22 - Start_time "2023-04-01T10:00:00Z" - End_time "2023-04-01T11:00:00Z" - Duration 00:02:04 - Total_bytes_send 800000 - Total_bytes_recv 400000 - Total_compressedbytes_send 560000 - Total_compressedbytes_recv 280000 - Compression_ratio_send 70.00% - Compression_ratio_recv 70.00% - Access Full - Group(s) "Developers,QA"
 Oct 6 14:03:23 <local0.info> 81.2.69.144 10/06/2014:14:03:23 GMT ns1 0-PPE-0 : SSLVPN TCPCONN_TIMEDOUT 4471 0 : User CharlieBrown - Client_ip 192.168.1.56 - Nat_ip 10.0.0.56 - Vserver 1.128.0.0:10443 - Last_contact "2023-04-01T13:00:00Z" - Group(s) "Sales,Marketing"

packages/citrix_adc/data_stream/log/_dev/test/pipeline/test-citrix-waf-native.log-expected.json

@@ -2568,6 +2568,109 @@
                 "name": "someusername"
             }
         },
+        {
+            "@timestamp": "2026-07-20T15:59:08.000Z",
+            "citrix": {
+                "cef_format": false,
+                "default_class": true,
+                "detail": "07/20/2026:15:59:08 GMT ns1 0-PPE-3 : default SSLVPN ICASTART 18346082 0 : Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername  - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd",
+                "device_event_class_id": "SSLVPN",
+                "extended": {
+                    "message": "Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername  - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd"
+                },
+                "facility": "local0",
+                "host": "ns1",
+                "name": "ICASTART",
+                "priority": "info"
+            },
+            "citrix_adc": {
+                "log": {
+                    "application_name": "WebApp-Desktop $P0000",
+                    "connection_id": "805bbd",
+                    "destination": {
+                        "ip": "192.168.1.1",
+                        "port": 80
+                    },
+                    "domain_name": "example",
+                    "message": "Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername  - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd",
+                    "source": {
+                        "ip": "10.0.0.1",
+                        "port": 12345
+                    },
+                    "ssl_relay": {
+                        "address": "172.16.0.1",
+                        "port": 443
+                    },
+                    "start_time": "2026-07-20T15:59:08.000Z",
+                    "username": "user.name"
+                }
+            },
+            "client": {
+                "geo": {
+                    "city_name": "London",
+                    "continent_name": "Europe",
+                    "country_iso_code": "GB",
+                    "country_name": "United Kingdom",
+                    "location": {
+                        "lat": 51.5142,
+                        "lon": -0.0931
+                    },
+                    "region_iso_code": "GB-ENG",
+                    "region_name": "England"
+                },
+                "ip": "81.2.69.144"
+            },
+            "destination": {
+                "ip": "192.168.1.1",
+                "port": 80
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "category": [
+                    "authentication"
+                ],
+                "id": "18346082",
+                "kind": "event",
+                "original": "Oct 6 14:03:23 <local0.info> 81.2.69.144 07/20/2026:15:59:08 GMT ns1 0-PPE-3 : default SSLVPN ICASTART 18346082 0 : Source 10.0.0.1:12345 - Destination 192.168.1.1:80 - SSLRelayAddress 172.16.0.1:443 - customername  - username:domainname user.name:example - applicationName WebApp-Desktop $P0000 - startTime \"07/20/2026:15:59:08 GMT\" - connectionId 805bbd",
+                "severity": 0,
+                "start": "2026-07-20T15:59:08.000Z",
+                "timezone": "GMT",
+                "type": [
+                    "info"
+                ]
+            },
+            "observer": {
+                "hostname": "ns1",
+                "product": "Netscaler",
+                "type": "firewall",
+                "vendor": "Citrix"
+            },
+            "related": {
+                "ip": [
+                    "10.0.0.1",
+                    "192.168.1.1",
+                    "81.2.69.144",
+                    "172.16.0.1"
+                ],
+                "user": [
+                    "user.name"
+                ]
+            },
+            "source": {
+                "ip": "10.0.0.1",
+                "port": 12345
+            },
+            "tags": [
+                "preserve_original_event",
+                "preserve_duplicate_custom_fields"
+            ],
+            "user": {
+                "domain": "example",
+                "name": "user.name"
+            }
+        },
         {
             "@timestamp": "2014-10-06T14:03:23.000Z",
             "citrix": {

packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -27,7 +27,7 @@ processors:
       tag: remove_newlines
       field: event.original
       ignore_missing: true
-      pattern: "\n"
+      pattern: "[\r\n]"
       replacement: ""
   - grok:
       description: Extract header details and message from log line.

packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/sslvpn_and_aaatm_feature.yml

@@ -42,7 +42,7 @@ processors:
       if: 'ctx.citrix.name == "ICASTART"'
       field: citrix.extended.message
       patterns:
-        - '^Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - SSLRelayAddress %{IP:citrix_adc.log.ssl_relay.address}:%{INT:citrix_adc.log.ssl_relay.port} - customername( %{WORD:citrix_adc.log.customer_name})? - username:domainname %{DATA:citrix_adc.log.username}:%{DATA:citrix_adc.log.domain_name} - applicationName %{DATA:citrix_adc.log.application_name} - startTime "%{DATA:_tmp.start_time}" - connectionId %{WORD:citrix_adc.log.connection_id} ?$'
+        - '^Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - SSLRelayAddress %{IP:citrix_adc.log.ssl_relay.address}:%{INT:citrix_adc.log.ssl_relay.port} - customername(?:%{SPACE}%{WORD:citrix_adc.log.customer_name})?%{SPACE}- username:domainname %{DATA:citrix_adc.log.username}:%{DATA:citrix_adc.log.domain_name} - applicationName %{DATA:citrix_adc.log.application_name} - startTime "%{DATA:_tmp.start_time}" - connectionId %{WORD:citrix_adc.log.connection_id}%{SPACE}$'
         - '^%{DATA} Source %{IP:citrix_adc.log.source.ip}:%{INT:citrix_adc.log.source.port} - Destination %{IP:citrix_adc.log.destination.ip}:%{INT:citrix_adc.log.destination.port} - customername (%{WORD:citrix_adc.log.customer_name})? - username:domainname %{DATA:citrix_adc.log.username}:%{DATA:citrix_adc.log.domain_name} - applicationName %{DATA:citrix_adc.log.application_name} - startTime "%{DATA:_tmp.start_time}" - connectionId %{WORD:citrix_adc.log.connection_id} ?$'
 
   - grok:

packages/citrix_adc/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.2"
 name: citrix_adc
 title: Citrix ADC
-version: "1.18.5"
+version: "1.18.6"
 description: This Elastic integration collects logs and metrics from Citrix ADC product.
 type: integration
 categories: