[Citrix ADC] Fix Grok parsing failure for LOGOUT and HTTPREQUEST of #14496#14781
Merged
yahyaghani merged 4 commits intoelastic:mainfrom Aug 19, 2025
Merged
Conversation
yahyaghani
added a commit
to yahyaghani/integrations
that referenced
this pull request
Aug 2, 2025
|
Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices) |
ilyannn
requested changes
Aug 4, 2025
Contributor
ilyannn
left a comment
There was a problem hiding this comment.
Solid start, but we need to figure out if any pattern changes, such as changes in optionality of the fields, are intended or not and whether they are what we want.
🚀 Benchmarks reportTo see the full report comment with |
6a2f1a3 to
f6a8bed
Compare
ilyannn
approved these changes
Aug 12, 2025
Contributor
ilyannn
left a comment
There was a problem hiding this comment.
LGTM
Please do add the missing end of line.
Would be also good to ask the opinion of people who worked on this integration.
| "session_id": "1756710", | ||
| "timestamp": "2024-07-12T06:54:39.000Z", | ||
| "timezone": "GMT :", | ||
| "timezone": "GMT", |
Contributor
There was a problem hiding this comment.
This was a clear bug! We should have caught this earlier.
Contributor
|
Please add to the |
mjwolf
reviewed
Aug 12, 2025
| patterns: | ||
| - '^User %{DATA:citrix_adc.log.user} - Client_ip (%{IP:citrix_adc.log.client_ip})? - Nat_ip (%{IP:citrix_adc.log.nat.ip}|"%{DATA}") - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Start_time "%{DATA:_tmp.start_time}" - End_time "%{DATA:_tmp.end_time}" - Duration %{DATA:citrix_adc.log.duration} - Http_resources_accessed %{INT:citrix_adc.log.http_resources_accessed} - (NonHttp_services_accessed %{INT:citrix_adc.log.non_http_services_accessed} - )?Total_TCP_connections %{INT:citrix_adc.log.total_tcp_connections} - (Total_UDP_flows %{INT:citrix_adc.log.total_udp_flows} - )?Total_policies_allowed %{INT:citrix_adc.log.total_policies_allowed} - Total_policies_denied %{INT:citrix_adc.log.total_policies_denied} - Total_bytes_send %{INT:citrix_adc.log.total_bytes_send} - Total_bytes_recv %{INT:citrix_adc.log.total_bytes_received} - Total_compressedbytes_send %{INT:citrix_adc.log.total_compressed_bytes_send} - Total_compressedbytes_recv %{INT:citrix_adc.log.total_compressed_bytes_recieved} - Compression_ratio_send %{NUMBER:citrix_adc.log.compression_ratio_send}% - Compression_ratio_recv %{NUMBER:citrix_adc.log.compression_ratio_recieved}% - LogoutMethod "%{DATA:citrix_adc.log.logout_method}" - Group\(s\) "%{DATA:citrix_adc.log.groups}" ?$' | ||
| - '^(Logout handler : )?Context %{DATA:citrix_adc.log.username}@%{IP} - SessionId: %{NUMBER:citrix_adc.log.session_id} - User %{DATA:citrix_adc.log.user} - Client_ip %{IP:citrix_adc.log.client_ip} - Nat_ip (%{IP:citrix_adc.log.nat.ip}|"%{DATA}") - Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port} - Start_time "%{DATA:_tmp.start_time}" - End_time "%{DATA:_tmp.end_time}" - Duration %{DATA:citrix_adc.log.duration} - Http_resources_accessed %{INT:citrix_adc.log.http_resources_accessed} - NonHttp_services_accessed %{INT:citrix_adc.log.non_http_services_accessed} - Total_TCP_connections %{INT:citrix_adc.log.total_tcp_connections} - Total_UDP_flows %{INT:citrix_adc.log.total_udp_flows} - Total_policies_allowed %{INT:citrix_adc.log.total_policies_allowed} - Total_policies_denied %{INT:citrix_adc.log.total_policies_denied} - Total_bytes_send %{INT:citrix_adc.log.total_bytes_send} - Total_bytes_recv %{INT:citrix_adc.log.total_bytes_received} - Total_compressedbytes_send %{INT:citrix_adc.log.total_compressed_bytes_send} - Total_compressedbytes_recv %{INT:citrix_adc.log.total_compressed_bytes_recieved} - Compression_ratio_send %{NUMBER:citrix_adc.log.compression_ratio_send}% - Compression_ratio_recv %{NUMBER:citrix_adc.log.compression_ratio_recieved}% - LogoutMethod "%{DATA:citrix_adc.log.logout_method}" - Group\(s\) "%{DATA:citrix_adc.log.groups}" ?$' | ||
| - '^(Logout handler : )?Context %{DATA:citrix_adc.log.username}@%{IP}%{SPACE}-%{SPACE}SessionId: %{NUMBER:citrix_adc.log.session_id}%{SPACE}-%{SPACE}User %{DATA:citrix_adc.log.user}%{SPACE}-%{SPACE}Client_ip %{IP:citrix_adc.log.client_ip}%{SPACE}-%{SPACE}Nat_ip (%{IP:citrix_adc.log.nat.ip}|\\?"%{DATA}\\?")%{SPACE}-%{SPACE}Vserver %{IP:citrix_adc.log.vserver.ip}:%{INT:citrix_adc.log.vserver.port}%{SPACE}-%{SPACE}Start_time \\?"%{DATA:_tmp.start_time}\\?"%{SPACE}-%{SPACE}End_time \\?"%{DATA:_tmp.end_time}\\?"%{SPACE}-%{SPACE}Duration %{NOTSPACE:citrix_adc.log.duration}%{SPACE}-%{SPACE}Http_resources_accessed %{INT:citrix_adc.log.http_resources_accessed}%{SPACE}-%{SPACE}(?:NonHttp_services_accessed %{INT:citrix_adc.log.non_http_services_accessed}%{SPACE}-%{SPACE})?Total_TCP_connections %{INT:citrix_adc.log.total_tcp_connections}%{SPACE}-%{SPACE}(?:Total_UDP_flows %{INT:citrix_adc.log.total_udp_flows}%{SPACE}-%{SPACE})?Total_policies_allowed %{INT:citrix_adc.log.total_policies_allowed}%{SPACE}-%{SPACE}Total_policies_denied %{INT:citrix_adc.log.total_policies_denied}%{SPACE}-%{SPACE}Total_bytes_send %{INT:citrix_adc.log.total_bytes_send}%{SPACE}-%{SPACE}Total_bytes_recv %{INT:citrix_adc.log.total_bytes_received}%{SPACE}-%{SPACE}Total_compressedbytes_send %{INT:citrix_adc.log.total_compressed_bytes_send}%{SPACE}-%{SPACE}Total_compressedbytes_recv %{INT:citrix_adc.log.total_compressed_bytes_recieved}%{SPACE}-%{SPACE}Compression_ratio_send %{NUMBER:citrix_adc.log.compression_ratio_send}%%{SPACE}-%{SPACE}Compression_ratio_recv %{NUMBER:citrix_adc.log.compression_ratio_recieved}%%{SPACE}-%{SPACE}LogoutMethod \\?"%{DATA:citrix_adc.log.logout_method}\\?"%{SPACE}-%{SPACE}Group\(s\) \\?"%{DATA:citrix_adc.log.groups}\\?" ?$' |
Contributor
There was a problem hiding this comment.
I think this is good, but using pattern_definitions to break up the pattern into something more manageable could be better.
I think it would reduce the very long line lengths, reduce repetition with the first pattern, and make the first pattern more robust by also giving it the %{SPACE} improvements, so it's probably worth trying to use pattern_definitions
Contributor
Author
There was a problem hiding this comment.
ok sure , I will try to break it up with pattern_definitions
💚 Build Succeeded
History
|
|
mjwolf
approved these changes
Aug 18, 2025
|
Package citrix_adc - 1.17.1 containing this change is available at https://epr.elastic.co/package/citrix_adc/1.17.1/ |
tehbooom
pushed a commit
to tehbooom/integrations
that referenced
this pull request
Nov 19, 2025
…lastic#14496 (elastic#14781) * [Citrix ADC]Fix Grok parsing failure for LOGOUT and HTTPREQUEST of [elastic#14496] * Add pattern_definitions to make the long patterns of LOGOUT & HTTPREQUEST more manageable * Update changelog and manifest
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📦 Citrix ADC Grok Parsing Fix: LOGOUT & HTTPREQUEST (#14496)
📝 Description
Fix parsing of LOGOUT and HTTPREQUEST messages that were failing due to misconfigured grok patterns.
Added third grok pattern for
grok_sslvpn_logoutandgrok_sslvpn_httprequestto handle log format variations seen in bug [Citrix ADC]: Grok Parsing Failure for LOGOUT & HTTPREQUEST #14496.💬 Proposed Commit Message
🕵️ Root Cause: Citrix ADC Grok Failures (LOGOUT & HTTPREQUEST)
🔴 1.
AAATM LOGOUTEvent Failure❗️ Failed Log
❌ Original Parsing Issues
NonHttp_services_accessed&Total_UDP_flows✅ Resolution
Added consolidated pattern supporting:
{SPACE}instead of🔴 2.
AAATM HTTPREQUESTEvent Failure❗️ Failed Log
❌ Original Parsing Issues
✅ Resolution
New flexible pattern supports:
📊 Summary of Pattern Improvements
🎯 Benefits
✅ Checklist
changelog.ymlfile.🧑💻 Author's Checklist
🧪 Testing
🔗 Related Issues
Closes #14496 — [Citrix ADC]: Grok Parsing Failure for LOGOUT & HTTPREQUEST
🔗 Resources
https://developer-docs.netscaler.com/en-us/netscaler-syslog-message-reference/current-release