updated the prometheus for compute13 libvirt exporter

helm-charts-observability/charts/data-prepper/values.yaml

@@ -276,6 +276,72 @@ pipelineConfig:
 
             value_split_characters: "="
             delete_value_regex: '^"|"$'
+        
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "CWD"'
+            target_key: cwd
+            match:
+              /audit/msg: 
+              - ^cwd=\"%{GREEDYDATA:path}\"
+        
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "USER_ACCT"'
+            target_key: user_account
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} auid=%{INT:auid} ses=%{INT:session} subj=%{GREEDYDATA:subject} msg='%{GREEDYDATA:msg}'.*\"%{WORD:user}\" AUID=\"%{WORD:AUID}\"
+
+        - key_value:
+            key_value_when: '/audit/log_type == "USER_ACCT"'
+            source: /user_account/msg
+            destination: /user_account/parsed_msg
+            field_split_characters: " "
+            value_split_characters: "="
+            delete_value_regex: '^"|"$'
+
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "LOGIN"'
+            target_key: login
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} subj=%{GREEDYDATA:subject} old-auid=%{INT:old-auid} auid=%{INT:auid} tty=%{GREEDYDATA:terminal} old-ses=%{INT:old-session} ses=%{INT:session} res=%{INT:result}.*UID=\"%{WORD:user}\" OLD-AUID=\"%{WORD:OLD-AUID}\" AUID=\"%{WORD:AUID}\"
+
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "USER_START"'
+            target_key: user_start
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} auid=%{INT:auid} ses=%{INT:session} subj=%{GREEDYDATA:subject} msg='%{GREEDYDATA:msg}'.*\"%{WORD:user}\" AUID=\"%{WORD:AUID}\"
+
+        - key_value:
+            key_value_when: '/audit/log_type == "USER_START"'
+            source: /user_start/msg
+            destination: /user_start/parsed_msg
+            field_split_characters: " "
+            value_split_characters: "="
+            delete_value_regex: '^"|"$'
+            
+
+        - grok:
+            break_on_match: true
+            grok_when: '/audit/log_type == "CRED_ACQ"'
+            target_key: cred_acq
+            match:
+              /audit/msg:
+              - ^pid=%{INT:pid} uid=%{INT:uid} auid=%{INT:auid} ses=%{INT:session} subj=%{GREEDYDATA:subject} msg='%{GREEDYDATA:msg}'.*\"%{WORD:user}\" AUID=\"%{WORD:AUID}\"
+
+        - key_value:
+            key_value_when: '/audit/log_type == "CRED_ACQ"'
+            source: /cred_acq/msg
+            destination: /cred_acq/parsed_msg
+            field_split_characters: " "
+            value_split_characters: "="
+            delete_value_regex: '^"|"$'
+
 
         - date:
             match: