elastic / elastic/integrations
[vsphere]: syslog grok patterns do not support formats with structured data
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
### Integration Name
VMware vSphere [vsphere]
### Dataset Name
log
### Integration Version
1.22.0
### Agent Version
n/a
### Agent Output Type
elasticsearch
### Elasticsearch Version
n/a
### OS Version and Architecture
n/a
### Software/API Version
_No response_
### Error Message
_No response_
### Event Original
_No response_
### What did you do?
ingested a syslog RFC5424-style message with structured data. the specific example is:
```
<14>1 2025-10-03T17:13:06.747Z some.host.name.com localcli 28451738 - [Originator@6876 priority="info" facility="user"] 28451738:VVOLLIB : VVolLib_SetLogLevel:1351: Log level for vvolLib set to 10
```
### What did you see?
the first syslog grok pattern[1], which targets RFC5424-style messages, does not match due to the structured data in the messsage. the second syslog grok pattern[2] matches instead, but since it's designed for RFC3164-style messages, causes the extracted fields to be incorrect.
in particular, we see the following result from the grok processor:
```
{
"process": {
"name": "localcli 28451738 - [Originator@6876 priority=\"info\" facility=\"user\"] 28451738:VVOLLIB "
},
"_tmp": {
"timestamp": "2025-10-03T17:13:06.747Z"
},
"log": {
"syslog": {
"priority": 14
}
},
"host": {
"name": "some.host.name.com"
},
"message": "VVolLib_SetLogLevel:1351: Log level for vvolLib set to 10",
...
}
```
[1] `^(%{ECS_SYSLOG_PRIORITY})?%{TIMESTAMP_ISO8601:_tmp.timestamp}%{SPACE}%{HOST}%{SPACE}%{NOTSPACE:process.name} (%{POSINT:process.pid:long}|-) - -%{SPACE}%{GREEDYDATA:message}`
[2] `^(%{ECS_SYSLOG_PRIORITY})?%{TIMESTAMP_ISO8601:_tmp.timestamp}%{SPACE}%{HOST}%{SPACE}%{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?\: %{GREEDYDATA:message}`
### What did you expect to see?
we expect to see `"process.name": "localcli"`, `"process.pid": 28451738`, `"message": "28451738:VVOLLIB : VVolLib_SetLogLevel:1351: Log level for vvolLib set to 10"`
### Anything else?
we should add support for structured data to the syslog grok patterns.
Contributor guide
Assessment
This issue has not been assessed yet.