Cherry-pick #10760 to 6.8: (#15980)

Adding Cisco support for the Syslog parser

* Adding Cisco support for the Syslog parser

Add support for the "sequence" number in the log format send by Cisco switch devices.

Fixes: #10654, #15979

(cherry picked from commit dd92b6f)

Co-authored-by: Pier-Hugues Pellerin <[email protected]>

CHANGELOG.next.asciidoc

@@ -38,6 +38,7 @@ https://github.com/elastic/beats/compare/v6.8.0...6.8.1[Check the HEAD diff]
 
 *Filebeat*
 
+- Add support for Cisco syslog format used by their switch. {pull}10760[10760]
 
 *Heartbeat*
 

filebeat/_meta/fields.common.yml

@@ -60,6 +60,12 @@
       description: >
         The Filebeat dataset that generated this event.
 
+    - name: event.sequence
+      type: long
+      required: false
+      description: >
+        The sequence number of this event.
+
     - name: syslog.facility
       type: long
       required: false

filebeat/docs/fields.asciidoc

@@ -3299,6 +3299,18 @@ The Filebeat fileset that generated this event.
 The Filebeat dataset that generated this event.
 
 
+--
+
+*`event.sequence`*::
++
+--
+type: long
+
+required: False
+
+The sequence number of this event.
+
+
 --
 
 *`syslog.facility`*::

filebeat/input/syslog/event.go

@@ -71,6 +71,7 @@ type event struct {
 	nanosecond int
 	year       int
 	loc        *time.Location
+	sequence   int
 }
 
 // newEvent() return a new event.
@@ -84,6 +85,7 @@ func newEvent() *event {
 		minute:   -1,
 		second:   -1,
 		year:     time.Now().Year(),
+		sequence: -1,
 	}
 }
 
@@ -269,6 +271,17 @@ func (s *event) HasPid() bool {
 	return s.pid > 0
 }
 
+// SetSequence set the sequence number for this event.
+func (s *event) SetSequence(b []byte) {
+	s.sequence = bytesToInt(b)
+}
+
+// Sequence returns the sequence number of the event when defined,
+// otherwise return -1.
+func (s *event) Sequence() int {
+	return s.sequence
+}
+
 // SetNanoSecond sets the nanosecond.
 func (s *event) SetNanosecond(b []byte) {
 	// We assume that we receive a byte array representing a nanosecond, this might not be

filebeat/input/syslog/input.go

@@ -37,6 +37,7 @@ import (
 
 // Parser is generated from a ragel state machine using the following command:
 //go:generate ragel -Z -G2 parser.rl -o parser.go
+//go:generate go fmt parser.go
 
 // Severity and Facility are derived from the priority, theses are the human readable terms
 // defined in https://tools.ietf.org/html/rfc3164#section-4.1.1.
@@ -251,6 +252,10 @@ func createEvent(ev *event, metadata inputsource.NetworkMetadata, timezone *time
 	f["event"] = event
 	f["process"] = process
 
+	if ev.Sequence() != -1 {
+		f["event.sequence"] = ev.Sequence()
+	}
+
 	return &beat.Event{
 		Timestamp: ev.Timestamp(timezone),
 		Meta: common.MapStr{

filebeat/input/syslog/input_test.go

@@ -176,6 +176,32 @@ func TestProgram(t *testing.T) {
 	})
 }
 
+func TestSequence(t *testing.T) {
+	t.Run("is set", func(t *testing.T) {
+		e := newEvent()
+		e.SetMessage([]byte("hello world"))
+		e.SetProgram([]byte("sudo"))
+		e.SetSequence([]byte("123"))
+		m := dummyMetadata()
+		event := createEvent(e, m, time.Local, logp.NewLogger("syslog"))
+		v, err := event.GetValue("event.sequence")
+		if !assert.NoError(t, err) {
+			return
+		}
+		assert.Equal(t, v, 123)
+	})
+
+	t.Run("is not set", func(t *testing.T) {
+		e := newEvent()
+		e.SetMessage([]byte("hello world"))
+		m := dummyMetadata()
+		event := createEvent(e, m, time.Local, logp.NewLogger("syslog"))
+
+		_, err := event.GetValue("event.sequence")
+		assert.Error(t, err)
+	})
+}
+
 func dummyMetadata() inputsource.NetworkMetadata {
 	ip := "127.0.0.1"
 	parsedIP := net.ParseIP(ip)