I have added second parsing pattern for SYSCALL because in the first pattern if the key is null then the full parser fails. So I have disabled break_on_match and added second parser for key=(null)

commit_msg.txt

@@ -0,0 +1 @@
+I have added second parsing pattern for SYSCALL because in the first pattern if the key is null then the full parser fails. So I have disabled break_on_match and added second parser for key=(null)

git_commit.sh

@@ -0,0 +1,3 @@
+git add .
+git commit --file commit_msg.txt
+git push origin main

helm-charts-observability/charts/data-prepper/values.yaml

@@ -232,7 +232,7 @@ pipelineConfig:
             target_key: audit
 
         - grok:
-            break_on_match: true
+            break_on_match: false
             grok_when: '/audit/log_type == "SYSCALL"'
             match:
               /audit/msg: 
@@ -246,6 +246,16 @@ pipelineConfig:
                 UID=\"%{GREEDYDATA:UID}\" GID=\"%{GREEDYDATA:GID}\" EUID=\"%{GREEDYDATA:EUID}\" SUID=\"%{GREEDYDATA:SUID}\" 
                 FSUID=\"%{GREEDYDATA:FSUID}\" 
                 EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
+              - ^arch=%{WORD:arch} syscall=%{INT:syscall_id} success=%{WORD:success} 
+                exit=%{INT:exit_code} a0=%{NOTSPACE:a0} a1=%{NOTSPACE:a1} a2=%{NOTSPACE:a2}
+                a3=%{NOTSPACE:a3} items=%{INT:items} ppid=%{INT:ppid} pid=%{INT:pid} auid=%{INT:auid} 
+                uid=%{INT:uid} gid=%{INT:gid} euid=%{INT:euid} suid=%{INT:suid} fsuid=%{INT:fsuid} 
+                egid=%{INT:egid} sgid=%{INT:sgid} fsgid=%{INT:fsgid} tty=%{GREEDYDATA:terminal} 
+                ses=%{INT:ses} comm=\"%{NOTSPACE:comm}\" exe=\"%{GREEDYDATA:exe}\" subj=%{GREEDYDATA:subject} 
+                key=\(%{WORD:key}\).*ARCH=%{GREEDYDATA:architecture} SYSCALL=%{WORD:syscall} AUID=\"%{GREEDYDATA:AUID}\" 
+                UID=\"%{GREEDYDATA:UID}\" GID=\"%{GREEDYDATA:GID}\" EUID=\"%{GREEDYDATA:EUID}\" SUID=\"%{GREEDYDATA:SUID}\" 
+                FSUID=\"%{GREEDYDATA:FSUID}\" 
+                EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
             target_key: syscall
         - date:
             match: