elastic / elastic/integrations
[Citrix ADC]: Parse out non "default" partition names
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
Citrix ADC [citrix_adc]
### Dataset Name
citrix_adc.log
### Integration Version
1.18.0
### Agent Version
8.19.8
### Agent Output Type
elasticsearch
### Elasticsearch Version
8.19.8
### OS Version and Architecture
ECH
### Software/API Version
_No response_
### Error Message
"root_cause": [
{
"type": "illegal_argument_exception",
"reason": "Provided Grok expressions do not match field value: [Part-Prod API CMD_EXECUTED 12345678 0]"
}
]
### Event Original
<134> 12/17/2025:12:16:45 NS-100 0-PPE-1 : Part-Prod API CMD_EXECUTED 12345678 0 : User ns_adm - ADM_User NONE - Remote_ip 172.16.1.1 - Command "stat serviceGroup sg-waf" - Status "Success"
### What did you do?
Standard integration configuration
### What did you see?
Pipeline error - Grok processor in logs-citrix_adc.log-1.18.0-native - parsing of the remainder of the document halted at this point
### What did you expect to see?
Full parsing of the event
### Anything else?
Netscaler has a concept of admin-partitions for the system: https://docs.netscaler.com/en-us/citrix-adc/current-release/admin-partition.html
If these are being used the name of the partition can appear in the logs, otherwise it is either left out or sent as "default"
The native log ingest pipeline expects the NetScaler partition to be named "default" as seen here: https://github.com/elastic/integrations/blob/f715dbb712dd673ea8f355c0fafbdfe960d59593/packages/citrix_adc/data_stream/log/elasticsearch/ingest_pipeline/native.yml#L29
This should be modified to parse out possible values for the partition names. According to NetScaler https://citrix-landing-page.readthedocs-hosted.com/projects/citrix-adc-command-reference/en/latest/ns/ns-partition/#arguments_2) :
`Name of the Partition. Must begin with an ASCII alphanumeric or underscore (_) character, and must contain only ASCII alphanumeric, underscore, hash (#), period (.), space, colon (:), at (@), equals (=), and hyphen (-) characters.`
I've updated the Grok pattern in my pipeline to account for these characters (except spaces), and the field is now being parsed as expected.
In my environments, partition names don't use spaces so I don't know how that part of the log would be formatted.
`"pattern_definitions": {
"DEFAULT": """[A-Za-z0-9_][A-Za-z0-9\-\.#@=:_]{0,127} """
}`
I think there should be two changes:
1. Change the grok parsing to account for correct partition names
2. Add the partition name to the document. It is currently not being used anywhere. Suggested field is citrix.partition
Contributor guide
Assessment
This issue has not been assessed yet.