elastic / elastic/integrations

[vsphere]: syslog grok patterns do not support formats with structured data

Open
#15,919 2 comments 1 reaction 0 assignees View on GitHub
Integration:vsphere needs:triage Team:Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

VMware vSphere [vsphere]

### Dataset Name

log

### Integration Version

1.22.0

### Agent Version

n/a

### Agent Output Type

elasticsearch

### Elasticsearch Version

n/a

### OS Version and Architecture

n/a

### Software/API Version

_No response_

### Error Message

_No response_

### Event Original

_No response_

### What did you do?

ingested a syslog RFC5424-style message with structured data. the specific example is:

```
<14>1 2025-10-03T17:13:06.747Z some.host.name.com localcli 28451738 - [Originator@6876 priority="info" facility="user"] 28451738:VVOLLIB : VVolLib_SetLogLevel:1351: Log level for vvolLib set to 10
```

### What did you see?

the first syslog grok pattern[1], which targets RFC5424-style messages, does not match due to the structured data in the messsage. the second syslog grok pattern[2] matches instead, but since it's designed for RFC3164-style messages, causes the extracted fields to be incorrect.

in particular, we see the following result from the grok processor:

```
{
"process": {
"name": "localcli 28451738 - [Originator@6876 priority=\"info\" facility=\"user\"] 28451738:VVOLLIB "
},
"_tmp": {
"timestamp": "2025-10-03T17:13:06.747Z"
},
"log": {
"syslog": {
"priority": 14
}
},
"host": {
"name": "some.host.name.com"
},
"message": "VVolLib_SetLogLevel:1351: Log level for vvolLib set to 10",
...
}
```

[1] `^(%{ECS_SYSLOG_PRIORITY})?%{TIMESTAMP_ISO8601:_tmp.timestamp}%{SPACE}%{HOST}%{SPACE}%{NOTSPACE:process.name} (%{POSINT:process.pid:long}|-) - -%{SPACE}%{GREEDYDATA:message}`
[2] `^(%{ECS_SYSLOG_PRIORITY})?%{TIMESTAMP_ISO8601:_tmp.timestamp}%{SPACE}%{HOST}%{SPACE}%{DATA:process.name}(?:\[%{POSINT:process.pid:long}\])?\: %{GREEDYDATA:message}`

### What did you expect to see?

we expect to see `"process.name": "localcli"`, `"process.pid": 28451738`, `"message": "28451738:VVOLLIB : VVolLib_SetLogLevel:1351: Log level for vvolLib set to 10"`

### Anything else?

we should add support for structured data to the syslog grok patterns.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.