Closed bloodmc closed 4 months ago
@bloodmc the issue here is that your pattern will not create a field. I agree that the error message is misleading (will put up a PR) but you can fix the issue by providing a field-name in the patterns:
grok_patterns = [
"%{BASE64_ENCODED:value}",
"%{SUSPICIOUS_COMMANDS:value}",
"%{POWERSHELL_USAGE:value}",
"%{NETWORK_ACTIVITY:value}",
"%{ENCODING_METHODS:value}",
"%{MALICIOUS_TOOLS:value}",
"%{SUSPICIOUS_BEHAVIOR:value}"
]
@bloodmc the issue here is that your pattern will not create a field. I agree that the error message is misleading (will put up a PR) but you can fix the issue by providing a field-name in the patterns:
grok_patterns = [ "%{BASE64_ENCODED:value}", "%{SUSPICIOUS_COMMANDS:value}", "%{POWERSHELL_USAGE:value}", "%{NETWORK_ACTIVITY:value}", "%{ENCODING_METHODS:value}", "%{MALICIOUS_TOOLS:value}", "%{SUSPICIOUS_BEHAVIOR:value}" ]
Ah yes the message was definitely misleading. Your change worked. Thanks!
@bloodmc what do you think about my message in PR #15318?
@bloodmc what do you think about my message in PR #15318?
Wouldn't it make more sense to log a message on startup if fields are missing? Could also default to value
if nothing is found?
@bloodmc I don't think you can find out if a regex has a named group, can you? Furthermore, using "value" as default doesn't work if you do have multiple groups. I would rather not try to be clever here to avoid breaking people... :-)
Fair enough, log is good then.
Relevant telegraf.conf
Logs from Telegraf
System info
Telegraf 1.30.1, Windows Server 2022 Standard and pushing logs to loki
Docker
Manual setup. (No docker used)
Steps to reproduce
Expected behavior
For logs to be matched correctly. In the example above, I would expect
SUSPICIOUS_COMMANDS
pattern to match the log line but it does not.Actual behavior
Powershell logs do not get matched. I tested with https://grokdebugger.com/ and everything is matched correctly.
Additional info
No response