From 12ef2933142c872f5641a77e148320f92c69563a Mon Sep 17 00:00:00 2001
From: Mosiur Rahman <connect.mosiur@gmail.com>
Date: Wed, 19 Aug 2026 04:09:12 +0000
Subject: [PATCH] I have added second parsing pattern for SYSCALL because in
 the first pattern if the key is null then the full parser fails. So I have
 disabled break_on_match and added second parser for key=(null)

---
 commit_msg.txt                                       |  1 +
 git_commit.sh                                        |  3 +++
 .../charts/data-prepper/values.yaml                  | 12 +++++++++++-
 3 files changed, 15 insertions(+), 1 deletion(-)
 create mode 100644 commit_msg.txt
 create mode 100644 git_commit.sh

diff --git a/commit_msg.txt b/commit_msg.txt
new file mode 100644
index 0000000..5213a2e
--- /dev/null
+++ b/commit_msg.txt
@@ -0,0 +1 @@
+I have added second parsing pattern for SYSCALL because in the first pattern if the key is null then the full parser fails. So I have disabled break_on_match and added second parser for key=(null)
diff --git a/git_commit.sh b/git_commit.sh
new file mode 100644
index 0000000..7a75679
--- /dev/null
+++ b/git_commit.sh
@@ -0,0 +1,3 @@
+git add .
+git commit --file commit_msg.txt
+git push origin main
diff --git a/helm-charts-observability/charts/data-prepper/values.yaml b/helm-charts-observability/charts/data-prepper/values.yaml
index 0ae09a2..b9f0d73 100644
--- a/helm-charts-observability/charts/data-prepper/values.yaml
+++ b/helm-charts-observability/charts/data-prepper/values.yaml
@@ -232,7 +232,7 @@ pipelineConfig:
             target_key: audit
 
         - grok:
-            break_on_match: true
+            break_on_match: false
             grok_when: '/audit/log_type == "SYSCALL"'
             match:
               /audit/msg: 
@@ -246,6 +246,16 @@ pipelineConfig:
                 UID=\"%{GREEDYDATA:UID}\" GID=\"%{GREEDYDATA:GID}\" EUID=\"%{GREEDYDATA:EUID}\" SUID=\"%{GREEDYDATA:SUID}\" 
                 FSUID=\"%{GREEDYDATA:FSUID}\" 
                 EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
+              - ^arch=%{WORD:arch} syscall=%{INT:syscall_id} success=%{WORD:success} 
+                exit=%{INT:exit_code} a0=%{NOTSPACE:a0} a1=%{NOTSPACE:a1} a2=%{NOTSPACE:a2}
+                a3=%{NOTSPACE:a3} items=%{INT:items} ppid=%{INT:ppid} pid=%{INT:pid} auid=%{INT:auid} 
+                uid=%{INT:uid} gid=%{INT:gid} euid=%{INT:euid} suid=%{INT:suid} fsuid=%{INT:fsuid} 
+                egid=%{INT:egid} sgid=%{INT:sgid} fsgid=%{INT:fsgid} tty=%{GREEDYDATA:terminal} 
+                ses=%{INT:ses} comm=\"%{NOTSPACE:comm}\" exe=\"%{GREEDYDATA:exe}\" subj=%{GREEDYDATA:subject} 
+                key=\(%{WORD:key}\).*ARCH=%{GREEDYDATA:architecture} SYSCALL=%{WORD:syscall} AUID=\"%{GREEDYDATA:AUID}\" 
+                UID=\"%{GREEDYDATA:UID}\" GID=\"%{GREEDYDATA:GID}\" EUID=\"%{GREEDYDATA:EUID}\" SUID=\"%{GREEDYDATA:SUID}\" 
+                FSUID=\"%{GREEDYDATA:FSUID}\" 
+                EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
             target_key: syscall
         - date:
             match: