Skip to content

[cisco_ios] Fix parsing of hostnames that start with a digit #13816

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 11 commits into
base: main
Choose a base branch
from
Open

[cisco_ios] Fix parsing of hostnames that start with a digit #13816

wants to merge 11 commits into from
+243 −4

Conversation

mjwolf
Copy link
Contributor

@mjwolf mjwolf commented May 7, 2025 •
edited by ilyannn
Loading

Proposed commit message

This PR improves the Cisco IOS ingest pipeline to properly handle hostnames that begin with digits. Even though such hostnames do not strictly conform to the Cisco IOS naming specification, hostnames starting with digits are commonly used in real-world configurations.

To do this we modified the grok pattern to allow such hostnames, e.g.

<190>3132811: 3router 3132807: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Numeric hostname with sequence

Due to the limitations of the grok parser's regex support, this also allowed all-digit hostnames, which caught cases like

<190>2361044: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format

where 2361044 is in the same place as the hostname but is instead a sequence number (compare

<190>sw01: Jul 14 2023 08:23:43.398 UTC: %FOO-6-BAR: Test header format

). We had to special-case this processing with additional ingest processors.

Another problem was created by timestamps like this

<46>: 2023 Aug 27 21:40:50 PDT: %...
<46>: 2023host Aug 27 21:40:50 PDT: %...

where 2023 is in fact part of the timestamp but 2023host is a valid hostname (and the timestamp does not contain the year at all). We fixed this issue by making sure that there is an additional attempt to recognize the timestamp pattern before proceeding with recognizing it as a hostname.

These cases are covered by new tests in test-numeric-hostname.log. Note that @timestamp is a dynamic field (the timestamp without a year refers to a current year), so correctness of some tests is not checked automatically.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

@mjwolf mjwolf requested a review from a team as a code owner May 7, 2025 04:22
@mjwolf mjwolf added enhancement New feature or request Integration:cisco_ios Cisco IOS bug Something isn't working, use only for issues and removed enhancement New feature or request labels May 7, 2025
@andrewkroh andrewkroh added the Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices] label May 7, 2025
@elasticmachine
Copy link

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

taylor-swanson
taylor-swanson reviewed May 9, 2025
View reviewed changes
Copy link
Contributor

@taylor-swanson taylor-swanson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we have a sample event that we can use as a test? Would like to see this in action.

@mjwolf
Copy link
Contributor Author

mjwolf commented May 9, 2025

Do we have a sample event that we can use as a test? Would like to see this in action.

The test in test-yearfirst-timestamp.log is what required special timestamp handling in the script

@taylor-swanson
Copy link
Contributor

Do we have a sample event that we can use as a test? Would like to see this in action.

The test in test-yearfirst-timestamp.log is what required special timestamp handling in the script

So re-generating test-yearfirst-timestamp.log results in this timestamp

2024 Aug 27 21:40:50 PDT

"@timestamp": "2025-08-27T21:40:50.000-07:00"

(I deleted the expected file and re-generated it, since @timestamp is marked as a dynamic field, and therefore doesn't get updated or verified):

Note the year. Unfortunately, this change is handling the year incorrectly (or not at all). main does not have this issue. This is the only regression, I also re-created the other expected files and they are the same.

@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented May 9, 2025 •
edited
Loading

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@ilyannn ilyannn self-assigned this May 11, 2025
@ilyannn ilyannn changed the title [cisco_ios] Improve hostname parsing [cisco_ios] Fix parsing of hostnames that start with a digit May 11, 2025
@ilyannn ilyannn enabled auto-merge (squash) May 11, 2025 23:27
@elasticmachine
Copy link

💚 Build Succeeded

History

cc @ilyannn

@elastic-sonarqube Elastic SonarQube
Copy link

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ilyannn ilyannn ilyannn left review comments

@taylor-swanson taylor-swanson Awaiting requested review from taylor-swanson

@andrewkroh andrewkroh Awaiting requested review from andrewkroh

At least 1 approving review is required to merge this pull request.

Assignees

@ilyannn ilyannn

Labels
bug Something isn't working, use only for issues Integration:cisco_ios Cisco IOS Team:Security-Deployment and Devices Deployment and Devices Security team [elastic/sec-deployment-and-devices]
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@mjwolf @elasticmachine @taylor-swanson @ilyannn @andrewkroh