search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
95 stars 4.92k forks source link

filebeat/module/auditd: implement support for ENRICHED format logs #37771

Open efd6 opened 9 months ago

efd6 commented 9 months ago

As described in https://github.com/elastic/integrations/issues/5343 for the auditd fleet integration auditd can have an ENRICHED format. This format uses the escape character (^[) to separate the standard structured data from the enriched fields resulting in failure of the original grok processor to construct fields correctly. This was fixed for the fleet package in elastic/integrations#8716, but the change was not reflected into the beats module.

Replay the equivalent of that PR for the filebeat auditd module here.

elasticmachine commented 9 months ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

elasticmachine commented 9 months ago

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)