elastic / elastic/integrations
[auditd]: Ingest Pipeline errors on initialization logs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Auditd Logs [auditd]
### Dataset Name
auditd
### Integration Version
3.22.0
### Agent Version
1.19 (ESF)
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.16.5
### OS Version and Architecture
RHEL8
### Software/API Version
_No response_
### Error Message
`Processor "kv" with tag "" in pipeline "logs-auditd.log-3.22.0" failed with message "field [auditd.log.kv] doesn't exist"`
### Event Original
`type=KERNEL msg=audit(1745246998.370:1): initialized`
### What did you do?
These logs are forwarded to elastic via elastic-serverless-forwarder hosted in AWS
### What did you see?
`Processor "kv" with tag "" in pipeline "logs-auditd.log-3.22.0" failed with message "field [auditd.log.kv] doesn't exist"`
### What did you expect to see?
No ingestion pipeline errors for auditd initialized logs
### Anything else?
I assume there just needs to be an ignore_failure or ignore_missing adding to the first 'kv' processor, to account for cases where the first grok processor only matches "%{AUDIT_PREFIX}" and doesn't set the auditd.log.kv field.
```
{
"kv": {
"field": "auditd.log.kv",
"field_split": "\\s+(?![\\w\\\"]+?(\\s+|$))",
"value_split": "(?
Contributor guide
Assessment
This issue has not been assessed yet.