Created the grok parser for EXECVE using CHATGPT and applied it to the pipeline now EXECVE is working properly

commit_msg.txt

@@ -1 +1 @@
-I have added second parsing pattern for SYSCALL because in the first pattern if the key is null then the full parser fails. So I have disabled break_on_match and added second parser for key=(null)
+Created the grok parser for EXECVE using CHATGPT and applied  it to the pipeline now EXECVE is working properly

helm-charts-observability/charts/data-prepper/values.yaml

@@ -257,6 +257,26 @@ pipelineConfig:
                 FSUID=\"%{GREEDYDATA:FSUID}\" 
                 EGID=\"%{GREEDYDATA:EGID}\" SGID=\"%{GREEDYDATA:SGID}\" FSGID=\"%{GREEDYDATA:FSGID}\"
             target_key: syscall
+       
+        - grok:
+            break_on_match: false
+            grok_when: '/audit/log_type == "EXECVE"'
+            target_key: execve
+            match:
+              /audit/msg:
+              - '^argc=%{INT:arg_count} %{GREEDYDATA:args_raw}$'
+
+        - key_value:
+            key_value_when: '/audit/log_type == "EXECVE"'
+            source: /execve/args_raw
+            destination: /execve/args
+
+            field_delimiter_regex: '\s+'
+            field_split_characters: ""
+
+            value_split_characters: "="
+            delete_value_regex: '^"|"$'
+
         - date:
             match:
               - key: /audit/timestamp_seconds