elastic / elastic/integrations

[auditd]: Ingest Pipeline errors on initialization logs

Open
#13,629 3 comments 0 reactions 0 assignees View on GitHub
Integration:auditd needs:triage Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Auditd Logs [auditd]

### Dataset Name

auditd

### Integration Version

3.22.0

### Agent Version

1.19 (ESF)

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.16.5

### OS Version and Architecture

RHEL8

### Software/API Version

_No response_

### Error Message

`Processor "kv" with tag "" in pipeline "logs-auditd.log-3.22.0" failed with message "field [auditd.log.kv] doesn't exist"`

### Event Original

`type=KERNEL msg=audit(1745246998.370:1): initialized`

### What did you do?

These logs are forwarded to elastic via elastic-serverless-forwarder hosted in AWS

### What did you see?

`Processor "kv" with tag "" in pipeline "logs-auditd.log-3.22.0" failed with message "field [auditd.log.kv] doesn't exist"`

### What did you expect to see?

No ingestion pipeline errors for auditd initialized logs

### Anything else?

I assume there just needs to be an ignore_failure or ignore_missing adding to the first 'kv' processor, to account for cases where the first grok processor only matches "%{AUDIT_PREFIX}" and doesn't set the auditd.log.kv field.

```
{
"kv": {
"field": "auditd.log.kv",
"field_split": "\\s+(?![\\w\\\"]+?(\\s+|$))",
"value_split": "(?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.