elastic / elastic/integrations

[Citrix ADC]: Parse out non "default" partition names

Open
#16,616 1 comment 0 reactions 0 assignees View on GitHub
bug Integration:citrix_adc Team:Integration-Experience
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

Citrix ADC [citrix_adc]

### Dataset Name

citrix_adc.log

### Integration Version

1.18.0

### Agent Version

8.19.8

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.19.8

### OS Version and Architecture

ECH

### Software/API Version

_No response_

### Error Message

"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Provided Grok expressions do not match field value: [Part-Prod API CMD_EXECUTED 12345678 0]"
}
]

### Event Original

<134> 12/17/2025:12:16:45 NS-100 0-PPE-1 : Part-Prod API CMD_EXECUTED 12345678 0 : User ns_adm - ADM_User NONE - Remote_ip 172.16.1.1 - Command "stat serviceGroup sg-waf" - Status "Success"

### What did you do?

Standard integration configuration

### What did you see?

Pipeline error - Grok processor in logs-citrix_adc.log-1.18.0-native - parsing of the remainder of the document halted at this point

### What did you expect to see?

Full parsing of the event

### Anything else?

Netscaler has a concept of admin-partitions for the system: https://docs.netscaler.com/en-us/citrix-adc/current-release/admin-partition.html
If these are being used the name of the partition can appear in the logs, otherwise it is either left out or sent as "default"

The native log ingest pipeline expects the NetScaler partition to be named "default" as seen here: https://github.com/elastic/integrations/blob/f715dbb712dd673ea8f355c0fafbdfe960d59593/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/native.yml#L29

This should be modified to parse out possible values for the partition names. According to NetScaler https://citrix-landing-page.readthedocs-hosted.com/projects/citrix-adc-command-reference/en/latest/ns/ns-partition/#arguments_2) :

`Name of the Partition. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters.`

I've updated the Grok pattern in my pipeline to account for these characters (except spaces), and the field is now being parsed as expected.
In my environments, partition names don't use spaces so I don't know how that part of the log would be formatted.

`"pattern_definitions": {
"DEFAULT": """[A-Za-z0-9_][A-Za-z0-9\-\.#@=:_]{0,127} """
}`

I think there should be two changes:
1. Change the grok parsing to account for correct partition names
2. Add the partition name to the document. It is currently not being used anywhere. Suggested field is citrix.partition

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.