mosiur/brilliant-monitoring
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

I have added second parsing pattern for SYSCALL because in the first pattern if the key is null then the full parser fails. So I have disabled break_on_match and added second parser for key=(null)

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-19 04:09:12 +00:00
parent 0f060b9315
commit 12ef293314
3 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
commit_msg.txt Normal file
View File

@@ -0,0 +1 @@
I have added second parsing pattern for SYSCALL because in the first pattern if the key is null then the full parser fails. So I have disabled break_on_match and added second parser for key=(null)

3
git_commit.sh Normal file
View File

@@ -0,0 +1,3 @@
git add .
git commit --file commit_msg.txt
git push origin main

12
helm-charts-observability/charts/data-prepper/values.yaml
View File

@@ -232,7 +232,7 @@ pipelineConfig:
target_key: audit
- grok:
break_on_match: true
break_on_match: false
grok_when: '/audit/log_type == "SYSCALL"'
match:
/audit/msg:
@@ -246,6 +246,16 @@ pipelineConfig:
UID=\"%{GREEDYDATA:UID}\" GID=\"%{GREEDYDATA:GID}\" EUID=\"%{GREEDYDATA:EUID}\" SUID=\"%{GREEDYDATA:SUID}\"
FSUID=\"%{GREEDYDATA:FSUID}\"
EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
- ^arch=%{WORD:arch} syscall=%{INT:syscall_id} success=%{WORD:success}
exit=%{INT:exit_code} a0=%{NOTSPACE:a0} a1=%{NOTSPACE:a1} a2=%{NOTSPACE:a2}
a3=%{NOTSPACE:a3} items=%{INT:items} ppid=%{INT:ppid} pid=%{INT:pid} auid=%{INT:auid}
uid=%{INT:uid} gid=%{INT:gid} euid=%{INT:euid} suid=%{INT:suid} fsuid=%{INT:fsuid}
egid=%{INT:egid} sgid=%{INT:sgid} fsgid=%{INT:fsgid} tty=%{GREEDYDATA:terminal}
ses=%{INT:ses} comm=\"%{NOTSPACE:comm}\" exe=\"%{GREEDYDATA:exe}\" subj=%{GREEDYDATA:subject}
key=\(%{WORD:key}\).*ARCH=%{GREEDYDATA:architecture} SYSCALL=%{WORD:syscall} AUID=\"%{GREEDYDATA:AUID}\"
UID=\"%{GREEDYDATA:UID}\" GID=\"%{GREEDYDATA:GID}\" EUID=\"%{GREEDYDATA:EUID}\" SUID=\"%{GREEDYDATA:SUID}\"
FSUID=\"%{GREEDYDATA:FSUID}\"
EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
target_key: syscall
- date:
match: