From ba0fd1d736ae11eea40ee03724f5e9f1ed16311e Mon Sep 17 00:00:00 2001 From: Mosiur Rahman Date: Wed, 19 Aug 2026 05:40:01 +0000 Subject: [PATCH] Created the grok parser for EXECVE using CHATGPT and applied it to the pipeline now EXECVE is working properly --- commit_msg.txt | 2 +- .../charts/data-prepper/values.yaml | 20 +++++++++++++++++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/commit_msg.txt b/commit_msg.txt index 5213a2e..291a970 100644 --- a/commit_msg.txt +++ b/commit_msg.txt @@ -1 +1 @@ -I have added second parsing pattern for SYSCALL because in the first pattern if the key is null then the full parser fails. So I have disabled break_on_match and added second parser for key=(null) +Created the grok parser for EXECVE using CHATGPT and applied it to the pipeline now EXECVE is working properly diff --git a/helm-charts-observability/charts/data-prepper/values.yaml b/helm-charts-observability/charts/data-prepper/values.yaml index b9f0d73..03bed63 100644 --- a/helm-charts-observability/charts/data-prepper/values.yaml +++ b/helm-charts-observability/charts/data-prepper/values.yaml @@ -257,6 +257,26 @@ pipelineConfig: FSUID=\"%{GREEDYDATA:FSUID}\" EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\" target_key: syscall + + - grok: + break_on_match: false + grok_when: '/audit/log_type == "EXECVE"' + target_key: execve + match: + /audit/msg: + - '^argc=%{INT:arg_count} %{GREEDYDATA:args_raw}$' + + - key_value: + key_value_when: '/audit/log_type == "EXECVE"' + source: /execve/args_raw + destination: /execve/args + + field_delimiter_regex: '\s+' + field_split_characters: "" + + value_split_characters: "=" + delete_value_regex: '^"|"$' + - date: match: - key: /audit/timestamp_seconds