Update cisco_meraki plugin to use key_value_parser #349
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jsirianni
requested changes
Oct 2, 2021
There was a problem hiding this comment.
I am not seeing much of an improvement here. I want the kv parser to succeeded but my sample data wont work.
<134>1 7623335469.640442956 local flows src=10.1.1.4 dst=8.8.8.8 mac=74:8E:F8:D4:66:40 protocol=udp sport=53986 dport=53 pattern: allow all
{"level":"error","timestamp":"2021-10-01T20:46:36.194-0400","message":"Failed to process entry","operator_id":"$.cisco_meraki.key_value_parser","operator_type":"key_value_parser","error":"3 errors occurred:\n\t* expected 'pattern:' to split by '=' into two items, got 1\n\t* expected 'allow' to split by '=' into two items, got 1\n\t* expected 'all' to split by '=' into two items, got 1\n\n","action":"send","entry":{"timestamp":"2021-06-10T10:31:09.640442954-04:00","severity":30,"severity_text":"134","labels":{"log_type":"cisco_meraki","net.host.ip":"::","net.host.port":"4444","net.peer.ip":"::1","net.peer.port":"52447","net.transport":"IP.UDP","plugin_id":"cisco_meraki"},"record":{"app_name":"flows","hostname":"SC_CORP_FW_01","message":"src=10.1.1.4 dst=8.8.8.8 mac=74:8E:F8:D4:66:40 protocol=udp sport=53986 dport=53 pattern: allow all","version":"1"}}}
{"level":"error","timestamp":"2021-10-01T20:46:36.194-0400","message":"error while writing entry: 3 errors occurred:\n\t* expected 'pattern:' to split by '=' into two items, got 1\n\t* expected 'allow' to split by '=' into two items, got 1\n\t* expected 'all' to split by '=' into two items, got 1\n\n","operator_id":"$.cisco_meraki.severity_parser","operator_type":"severity_parser"}Perhaps something is wrong, or we just need to stick with master's implementation.
|
This log entry was used when the plugin was orginially written. I believe we haven't yet seen this format in another environment. Try this format. This is what we have seen in other environments. I have yet to see the format above. Perhaps we were working with bad sample logs. I took off the ending portion |
jsirianni
approved these changes
Oct 4, 2021
jsirianni
pushed a commit
that referenced
this pull request
Oct 5, 2021
* Update regex to parse IPv6 (#334) Update default listener log path * Add HAProxy Plugin (#335) * Add haproxy plugin * Add supported platforms and min stanza version * PR Feedback fixes * Rename frontend_name to frontend_name_transport in regex * for all move operations, check if field is nil before moving. "set log type to haproxy and haproxy.error (not .http / .tcp)" * typoe: nill --> nil * typo, log_format: http --> default Co-authored-by: jsirianni <[email protected]> * Allow DBID to be empty & Correct case matching (#331) * Allow DBID to be empty & Correct case matching The DBID field is able to be empty on some versions of Oracle DB The multiline regex was looking for `Audit File`, but logs have `Audit file` * Switch to line end for multiline with double newline pattern * Fix plugin failure when using inline truncate check * Switch back to a regex parse for record splitting Co-authored-by: jsirianni <[email protected]> * Release 0.0.79 (#336) * 0.0.79 changelog * dbid oracle pr * fix release date * move frontend port to resources (#338) * Add more checks to reduce errors (#337) * Add more checks to reduce errors * Add ac_lite_ap_parser change to changelog for ubiquiti * 0.0.80 changelog Co-authored-by: jsirianni <[email protected]> * update regex to handle {} brackets before http request info (#342) * update regex to handle {} brackets before http request info * haproxy http default log format fix * make change backwards compatible * Adjust parsing further based on more detailed oracle db audit logs (#343) * release 0.0.82 * CI Testing: End to End Tests (#345) * end to end nginx testing * fix format * fix format * use sudo to compare against files from container mount * sleep so stanza can parse, kill stanza when done * try cloning log library * use token to clone lob lib * fix repo name * fix expect and output paths * handle both nginx formats * add apache_http workflow * dump container log * dump container log * 10 second sleep * use jq with diff to prevent formatting issues * sudo * cannot use sudo with redirection to diff, so just format with jq before using diff * Switch back to diff, something else is going on.. * pause and cat raw output before comparing * sudo * fix paths * sort before compare * redirect output * sort and cat * use jtool for comparing json files * use jtool for comparing json files * chmod it * haproxy workflow * add oracledb workflow * single test case for oracledb * mount plugins dir * stop and then get stanza logs * sleep 20 seconds instead of 10, sometimes 10 is not enough * fix log dirg * install jtool in its own step * fix mount * split oracle up. start with alert logs * oracle audit log * upgrade jtool and use skip timestamp for haproxy and oracle * upgrade jtoo * upgrade jtool * pause, stop, logs * listener log, oracle * Handle second {} in http log entry if present (#346) Co-authored-by: jsirianni <[email protected]> * Add tcpudp plugin (#341) * Add tcpudp plugin * Add tcpudp schema and tests * Split into two plugins udp and tcp * Add schema files for tests * Update plugins/tcp.yaml * Update plugins/tcp.yaml * Update plugins/udp.yaml * Update plugins/udp.yaml * Update test/configs/tcp/invalid/invalid_listen_port.yaml * Update plugins/udp.yaml Co-authored-by: jsirianni <[email protected]> Co-authored-by: Joseph Sirianni <[email protected]> * tcp / udp: move to message field (#347) * move to message field * \n * Add common event format plugin (#328) * Add common event format plugin * use key value parser for parsing extensions field * Promote fields to labels and resources * Promote fields to labels and resources * Update changelog * Remove key value parser * Add promote device_vendor and device_version to resources Co-authored-by: jsirianni <[email protected]> Co-authored-by: jsirianni <[email protected]> * release 0.0.83 * Add http plugin (#352) * Add http plugin * Update log_type label to http * remove duplicate param * tcp --> http * typo * token_header --> auth_header * small refactor * upgrade stanza 1.2.9 Co-authored-by: jsirianni <[email protected]> * Update Titles and uwsgi field name (#350) Co-authored-by: Joseph Sirianni <[email protected]> * Update cisco_meraki plugin to use key_value_parser (#349) * Update cisco_meraki plugin to use key_value_parser instead of custom regex * use stanza 1.2.9 Co-authored-by: jsirianni <[email protected]> * Create Sonicwall log parser plugin (#340) * Create Sonicwall log parser plugin * Add pri field severity_parser * Rename msg field to message * Add parameter location to support setting timezone * Update to use udp_input and add extra tests * Use stanza 1.2.7 for tests * update stanza and get go.sum * Update plugins/sonicwall.yaml Co-authored-by: Joseph Sirianni <[email protected]> * Fix using wrong parameter if you defined listen_port Co-authored-by: jsirianni <[email protected]> Co-authored-by: Joseph Sirianni <[email protected]> * release-0.0.84 * fix ci link * remove start_at reference * remove start_at test for sonicwall, not needed * enable new operators * fix start_at for w3c tests due to delete_at_end being added * Add cisco_catalyst plugin (#351) * Add cisco_catalyst plugin * Add severity field group to regex. Update parse from field for severity and regex. * Remove parse_to message in udp_input and parse_from message in regex_parser * fix ci link * remove start_at reference * remove start_at test for sonicwall, not needed * enable new operators * fix start_at for w3c tests due to delete_at_end being added Co-authored-by: Joseph Sirianni <[email protected]> * remove tests for now, not compatable with otel branch * remove tests for now, not compatable with otel branch * port cisco catalyst to otel * fix cef * fix haproxy * port http * port sonicwall * fix haproxy * Update plugins/cisco_catalyst.yaml Co-authored-by: Keith Schmitt <[email protected]> * rebase oracledb * try and fix severities that were missed Co-authored-by: Dylan Myers <[email protected]> Co-authored-by: EricWHolt <[email protected]> Co-authored-by: Keith Schmitt <[email protected]> Co-authored-by: schmikei <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This updates the
cisco_merakiplugin to usekey_value_parseroperator instead of a few very specific regex parsers. This should parse any valid key value pairs within the message field.