[Citrix ADC]: Timestamp parsing error

### Integration Name

citrix_adc

### Dataset Name

log?

### Integration Version

1.18.5

### Agent Version

8.17.1

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.4

### OS Version and Architecture

Docker based

### Software/API Version

_No response_

### Error Message

`
"error": {
"message": [
"Processor date with tag date_timestamp_native in pipeline _simulate_pipeline failed with message: Failed to parse with all enclosed parsers",
"Processor date with tag date_delink_time in pipeline _simulate_pipeline failed with message: Failed to parse with all enclosed parsers"
]
}
`

### Event Original

`<134> 22/04/2026:17:04:11 GMT redacted : default TCP CONN_DELINK 125139210 0 : Source redacted:53723 - Vserver 10.175.10.28:443 - NatIP 10.xxx.6.22:48528 - Destination 10.xxx.16.20:443 - Delink Time 22/04/2026:17:04:11 GMT - Total_bytes_send 0 - Total_bytes_recv 1749"`

### What did you do?

Follows a fix for the timestamp parsing.

`PUT _ingest/pipeline/logs-citrix_adc.log-1.18.5
{
"description": "Pipeline for Citrix Web App Firewall logs.",
"on_failure": [
{
"remove": {
"ignore_missing": true,
"tag": "remove_tmp_and_conf",
"field": [
"_tmp",
"_conf"
]
}
},
{
"append": {
"field": "error.message",
"value": "Processor \"{{{ _ingest.on_failure_processor_type }}}\" with tag \"{{{ _ingest.on_failure_processor_tag }}}\" in pipeline \"{{{ _ingest.on_failure_pipeline }}}\" failed with message \"{{{ _ingest.on_failure_message }}}\""
}
},
{
"set": {
"tag": "set_pipeline_error_to_event_kind",
"field": "event.kind",
"value": "pipeline_error"
}
},
{
"append": {
"field": "tags",
"allow_duplicates": false,
"value": "preserve_original_event"
}
}
],
"_meta": {
"package": {
"name": "citrix_adc"
},
"managed_by": "fleet",
"managed": true
},
"processors": [
{
"set": {
"tag": "set_ecs_version",
"field": "ecs.version",
"value": "8.11.0"
}
},
{
"set": {
"tag": "set_observer_vendor",
"field": "observer.vendor",
"value": "Citrix"
}
},
{
"set": {
"tag": "set_observer_product",
"field": "observer.product",
"value": "Netscaler"
}
},
{
"set": {
"tag": "set_observer_type",
"field": "observer.type",
"value": "firewall"
}
},
{
"rename": {
"ignore_missing": true,
"tag": "rename_message",
"field": "message",
"target_field": "event.original",
"if": "ctx.event?.original == null"
}
},
{
"gsub": {
"pattern": "\n",
"ignore_missing": true,
"tag": "remove_newlines",
"field": "event.original",
"replacement": ""
}
},
{
"grok": {
"description": "Extract header details and message from log line.",
"tag": "grok_event_original",
"field": "event.original",
"pattern_definitions": {
"LEVEL": "?",
"TIMESTAMP_ISO8601": "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE:_tmp.tz}?",
"IDENT": "[a-zA-Z][a-zA-Z0-9]*",
"SYSLOG_TIMESTAMP": "(?:%{SYSLOGTIMESTAMP:_tmp.syslog_timestamp}|%{TIMESTAMP_ISO8601:_tmp.syslog_timestamp8601})"
},
"patterns": [
"^%{SYSLOG_TIMESTAMP}( %{LEVEL} %{IP:client.ip:ip})?( %{HOSTNAME:citrix.hostname})? %{GREEDYDATA:citrix.detail}",
"^%{GREEDYDATA:citrix.detail}"
]
}
},
{
"pipeline": {
"name": "logs-citrix_adc.log-1.18.5-native",
"tag": "pipeline_native",
"if": "ctx.citrix?.detail != null && !ctx.citrix.detail.startsWith(\"CEF:\")"
}
},
{
"set": {
"tag": "set_cef_detail_from_extended_message",
"override": true,
"field": "citrix.detail",
"copy_from": "citrix.extended.message",
"if": "ctx.citrix?.extended?.message != null && ctx.citrix.extended.message.startsWith(\"CEF:\")"
}
},
{
"pipeline": {
"name": "logs-citrix_adc.log-1.18.5-cef",
"tag": "pipeline_cef",
"if": "ctx.citrix?.detail != null && ctx.citrix.detail.startsWith(\"CEF:\")"
}
},
{
"convert": {
"ignore_missing": true,
"tag": "convert_event_severity_to_long",
"field": "event.severity",
"type": "long"
}
},
{
"set": {
"field": "_tmp.tz",
"value": "UTC",
"if": "ctx._tmp?.tz == 'Z'"
}
},
{
"set": {
"ignore_empty_value": true,
"override": false,
"field": "_tmp.tz",
"copy_from": "_conf.tz_offset"
}
},
{
"set": {
"override": false,
"field": "_tmp.tz",
"copy_from": "event.timezone",
"if": "ctx.event?.timezone != null"
}
},
{
"set": {
"override": false,
"field": "_tmp.tz",
"value": "UTC"
}
},
{
"set": {
"field": "event.timezone",
"copy_from": "_tmp.tz"
}
},
{
"date": {
"on_failure": [
{
"append": {
"field": "error.message",
"value": "Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}"
}
}
],
"formats": [
"ISO8601"
],
"field": "_tmp.syslog_timestamp8601",
"timezone": "{{{event.timezone}}}",
"tag": "date_syslog_timestamp8601",
"if": "ctx._tmp?.timestamp8601 != null"
}
},
{
"set": {
"tag": "enrich_syslog_timestamp_with_year",
"field": "_tmp.syslog_timestamp",
"if": "ctx._tmp?.syslog_timestamp != null && ctx.citrix?.event_year != null",
"value": "{{{citrix.event_year}}} {{{_tmp.syslog_timestamp}}}"
}
},
{
"remove": {
"ignore_missing": true,
"tag": "remove_event_year",
"field": "citrix.event_year"
}
},
{
"date": {
"on_failure": [
{
"append": {
"field": "error.message",
"value": "Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}"
}
}
],
"formats": [
"MMM d HH:mm:ss",
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"MMMM d HH:mm:ss",
"MMMM d HH:mm:ss",
"MMMM dd HH:mm:ss",
"yyyy MMM d HH:mm:ss",
"yyyy MMM d HH:mm:ss",
"yyyy MMM dd HH:mm:ss",
"yyyy MMMM d HH:mm:ss",
"yyyy MMMM d HH:mm:ss",
"yyyy MMMM dd HH:mm:ss"
],
"field": "_tmp.syslog_timestamp",
"timezone": "{{{event.timezone}}}",
"tag": "date_syslog_timestamp",
"if": "ctx._tmp?.syslog_timestamp != null"
}
},
{
"script": {
"tag": "trim_time_fields",
"source": "params.fields.forEach(field -> {\n if (!ctx._tmp?.containsKey(field) || !(ctx._tmp[field] instanceof String)) {\n return true;\n }\n\n String val = ctx._tmp[field];\n ctx._tmp[field] = val.trim();\n});",
"lang": "painless",
"params": {
"fields": [
"timestamp_native",
"timestamp",
"delink_time",
"start_time",
"end_time"
]
}
}
},
{
"script": {
"tag": "parse_custom_time_formats",
"source": "def zone = ctx.event?.timezone != null ? ZoneId.of(ctx.event.timezone) : null;\ndef formatter = DateTimeFormatter.ofPattern(ctx._conf.custom_date_format);\ndef outFormatter = DateTimeFormatter.ofPattern(\"yyyy-MM-dd'T'HH:mm:ss.SSSXXX\");\n\nparams.fields.forEach(field -> {\n if (!ctx._tmp?.containsKey(field)) {\n return true;\n }\n\n try {\n def localDateTime = LocalDateTime.parse(ctx._tmp[field], formatter);\n ctx.citrix_adc.log[field] = outFormatter.format(ZonedDateTime.of(localDateTime, zone));\n } catch (Exception e) {\n /* Intentionally ignored */\n return true;\n }\n});",
"lang": "painless",
"params": {
"fields": [
"timestamp_native",
"timestamp",
"delink_time",
"start_time",
"end_time"
]
},
"if": "ctx._conf?.custom_date_format != null"
}
},
{
"date": {
"on_failure": [
{
"append": {
"field": "error.message",
"value": "Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}"
}
}
],
"formats": [
"ISO8601",
"yyyy/MM/dd:HH:mm:ss",
"yyyy/MM/dd:HH:mm:ss z",
"MM/dd/yyyy:HH:mm:ss",
"MM/dd/yyyy:HH:mm:ss z",
"dd/MM/yyyy:HH:mm:ss",
"dd/MM/yyyy:HH:mm:ss z"
],
"field": "_tmp.timestamp_native",
"target_field": "citrix_adc.log.timestamp_native",
"timezone": "{{{event.timezone}}}",
"tag": "date_timestamp_native",
"if": "ctx._tmp?.timestamp_native != null && ctx.citrix_adc?.log?.timestamp_native == null"
}
},
{
"date": {
"on_failure": [
{
"append": {
"field": "error.message",
"value": "Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}"
}
}
],
"formats": [
"ISO8601",
"yyyy/MM/dd:HH:mm:ss",
"yyyy/MM/dd:HH:mm:ss z",
"MM/dd/yyyy:HH:mm:ss",
"MM/dd/yyyy:HH:mm:ss z",
"dd/MM/yyyy:HH:mm:ss",
"dd/MM/yyyy:HH:mm:ss z"
],
"field": "_tmp.timestamp",
"target_field": "citrix_adc.log.timestamp",
"timezone": "{{{event.timezone}}}",
"tag": "date_timestamp",
"if": "ctx._tmp?.timestamp != null && ctx.citrix_adc?.log?.timestamp == null"
}
},
{
"date": {
"on_failure": [
{
"append": {
"field": "error.message",
"value": "Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}"
}
}
],
"formats": [
"ISO8601",
"yyyy/MM/dd:HH:mm:ss",
"yyyy/MM/dd:HH:mm:ss z",
"MM/dd/yyyy:HH:mm:ss",
"MM/dd/yyyy:HH:mm:ss z",
"dd/MM/yyyy:HH:mm:ss",
"dd/MM/yyyy:HH:mm:ss z"
],
"field": "_tmp.start_time",
"target_field": "citrix_adc.log.start_time",
"timezone": "{{{event.timezone}}}",
"tag": "date_start_time",
"if": "ctx._tmp?.start_time != null && ctx.citrix_adc?.log?.start_time == null"
}
},
{
"date": {
"on_failure": [
{
"append": {
"field": "error.message",
"value": "Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}"
}
}
],
"formats": [
"ISO8601",
"yyyy/MM/dd:HH:mm:ss",
"yyyy/MM/dd:HH:mm:ss z",
"yyyy/MM/dd:HH:mm:ssz",
"MM/dd/yyyy:HH:mm:ss",
"MM/dd/yyyy:HH:mm:ss z",
"MM/dd/yyyy:HH:mm:ssz",
"dd/MM/yyyy:HH:mm:ss",
"dd/MM/yyyy:HH:mm:ss z",
"dd/MM/yyyy:HH:mm:ssz"
],
"field": "_tmp.end_time",
"target_field": "citrix_adc.log.end_time",
"timezone": "{{{event.timezone}}}",
"tag": "date_end_time",
"if": "ctx._tmp?.end_time != null && ctx.citrix_adc?.log?.end_time == null"
}
},
{
"date": {
"on_failure": [
{
"append": {
"field": "error.message",
"value": "Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}"
}
}
],
"formats": [
"ISO8601",
"yyyy/MM/dd:HH:mm:ss",
"yyyy/MM/dd:HH:mm:ss z",
"MM/dd/yyyy:HH:mm:ss",
"MM/dd/yyyy:HH:mm:ss z",
"dd/MM/yyyy:HH:mm:ss",
"dd/MM/yyyy:HH:mm:ss z"
],
"field": "_tmp.delink_time",
"target_field": "citrix_adc.log.delink_time",
"timezone": "{{{event.timezone}}}",
"tag": "date_delink_time",
"if": "ctx._tmp?.delink_time != null && ctx.citrix_adc?.log?.delink_time == null"
}
},
{
"set": {
"ignore_empty_value": true,
"tag": "set_@timestamp_from_citrix_native",
"field": "@timestamp",
"copy_from": "citrix_adc.log.timestamp_native"
}
},
{
"remove": {
"ignore_missing": true,
"tag": "remove_citrix_timestamp_native",
"field": "citrix_adc.log.timestamp_native"
}
},
{
"set": {
"ignore_empty_value": true,
"tag": "set_event_start_from_citrix_start_time",
"field": "event.start",
"copy_from": "citrix_adc.log.start_time"
}
},
{
"set": {
"ignore_empty_value": true,
"tag": "set_event_end_from_citrix_delink_time",
"field": "event.end",
"copy_from": "citrix_adc.log.delink_time"
}
},
{
"set": {
"ignore_empty_value": true,
"tag": "set_event_end_from_citrix_end_time",
"field": "event.end",
"copy_from": "citrix_adc.log.end_time"
}
},
{
"script": {
"description": "Calculates duration from event.start and event.end, as its easer than parsing citrix_adc.log.duration",
"source": "ZonedDateTime start = ZonedDateTime.parse(ctx.event.start); ZonedDateTime end = ZonedDateTime.parse(ctx.event.end); ctx.event.duration = ChronoUnit.NANOS.between(start, end);",
"tag": "calculate_event_duration",
"lang": "painless",
"if": "ctx?.event?.start != null && ctx?.event?.end != null && ctx?.event?.duration == null"
}
},
{
"geoip": {
"ignore_missing": true,
"tag": "geoip_client_ip_to_client_geo",
"field": "client.ip",
"target_field": "client.geo"
}
},
{
"geoip": {
"ignore_missing": true,
"tag": "geoip_source_ip_to_source_geo",
"field": "source.ip",
"target_field": "source.geo"
}
},
{
"geoip": {
"field": "source.ip",
"target_field": "source.as",
"database_file": "GeoLite2-ASN.mmdb",
"ignore_missing": true,
"tag": "geoip_source_ip_to_source_as",
"properties": [
"asn",
"organization_name"
]
}
},
{
"geoip": {
"field": "client.ip",
"target_field": "client.as",
"database_file": "GeoLite2-ASN.mmdb",
"ignore_missing": true,
"tag": "geoip_client_ip_to_client_as",
"properties": [
"asn",
"organization_name"
]
}
},
{
"rename": {
"ignore_missing": true,
"tag": "rename_source_as_asn",
"field": "source.as.asn",
"target_field": "source.as.number"
}
},
{
"rename": {
"ignore_missing": true,
"tag": "rename_source_as_organization_name",
"field": "source.as.organization_name",
"target_field": "source.as.organization.name"
}
},
{
"rename": {
"ignore_missing": true,
"tag": "rename_client_as_asn",
"field": "client.as.asn",
"target_field": "client.as.number"
}
},
{
"rename": {
"ignore_missing": true,
"tag": "rename_client_as_organization_name",
"field": "client.as.organization_name",
"target_field": "client.as.organization.name"
}
},
{
"uri_parts": {
"tag": "uri_parts_url_original",
"field": "url.original",
"target_field": "url",
"if": "ctx.url?.original != null && ctx.url?.original != \"\""
}
},
{
"rename": {
"tag": "rename_user_email",
"field": "user.name",
"target_field": "user.email",
"if": "ctx.user?.name != null && ctx.user.name.indexOf(\"@\") > 0"
}
},
{
"dissect": {
"ignore_failure": true,
"field": "user.email",
"pattern": "%{user.name}@%{user.domain}",
"ignore_missing": true,
"tag": "dissect_user_email",
"if": "ctx.user?.name == null && ctx.user?.domain == null"
}
},
{
"append": {
"tag": "append_user_name",
"field": "related.user",
"allow_duplicates": false,
"value": "{{{user.name}}}",
"if": "ctx.user?.name != null"
}
},
{
"append": {
"tag": "append_user_email",
"field": "related.user",
"allow_duplicates": false,
"value": "{{{user.email}}}",
"if": "ctx.user?.email != null"
}
},
{
"rename": {
"tag": "rename_source_user_email",
"field": "source.user.name",
"target_field": "source.user.email",
"if": "ctx.source?.user?.name != null && ctx.source.user.name.indexOf(\"@\") > 0"
}
},
{
"dissect": {
"ignore_failure": true,
"field": "source.user.email",
"pattern": "%{source.user.name}@%{source.user.domain}",
"ignore_missing": true,
"tag": "dissect_source_user_email",
"if": "ctx.source?.user?.name == null && ctx.source?.user?.domain == null"
}
},
{
"append": {
"tag": "append_source_user_name",
"field": "related.user",
"allow_duplicates": false,
"value": "{{{source.user.name}}}",
"if": "ctx.source?.user?.name != null"
}
},
{
"append": {
"tag": "append_source_user_email",
"field": "related.user",
"allow_duplicates": false,
"value": "{{{source.user.email}}}",
"if": "ctx.source?.user?.email != null"
}
},
{
"rename": {
"tag": "rename_destination_user_email",
"field": "destination.user.name",
"target_field": "destination.user.email",
"if": "ctx.destination?.user?.name != null && ctx.destination.user.name.indexOf(\"@\") > 0"
}
},
{
"dissect": {
"ignore_failure": true,
"field": "destination.user.email",
"pattern": "%{destination.user.name}@%{destination.user.domain}",
"ignore_missing": true,
"tag": "dissect_destination_user_email",
"if": "ctx.destination?.user?.name == null && ctx.destination?.user?.domain == null"
}
},
{
"append": {
"tag": "append_destination_user_name",
"field": "related.user",
"allow_duplicates": false,
"value": "{{{destination.user.name}}}",
"if": "ctx.destination?.user?.name != null"
}
},
{
"append": {
"tag": "append_destination_user_email",
"field": "related.user",
"allow_duplicates": false,
"value": "{{{destination.user.email}}}",
"if": "ctx.destination?.user?.email != null"
}
},
{
"script": {
"description": "Drops null/empty values recursively",
"tag": "drop_empty_fields",
"source": "boolean dropEmptyFields(Object object) {\n if (object == null || object == \"\") {\n return true;\n } else if (object instanceof Map) {\n ((Map) object).values().removeIf(value -> dropEmptyFields(value));\n return (((Map) object).size() == 0);\n } else if (object instanceof List) {\n ((List) object).removeIf(value -> dropEmptyFields(value));\n return (((List) object).length == 0);\n }\n return false;\n}\ndropEmptyFields(ctx);\n",
"lang": "painless"
}
},
{
"remove": {
"ignore_missing": true,
"tag": "remove_tmp_and_conf",
"field": [
"_tmp",
"_conf"
]
}
},
{
"append": {
"tag": "append_preserve_original_event_on_error",
"field": "tags",
"allow_duplicates": false,
"value": "preserve_original_event",
"if": "ctx.error?.message != null"
}
}
]
}`

### What did you see?

See the error message above

### What did you expect to see?

I expect the timestamp parsed correctly

### Anything else?

_No response_