[cisco_aironet] Parse strict ARP and NTP rejection variants - #20923
[cisco_aironet] Parse strict ARP and NTP rejection variants#20923ie-ops wants to merge 6 commits into
Conversation
ie-ops
added
enhancement
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
🚀 Benchmarks reportTo see the full report comment with |
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
There was a problem hiding this comment.
Pull request overview
This PR updates the Cisco Aironet log ingest pipeline to handle LOG-4-Q_IND messages more safely by adding SNTP parsing support, adding new SNTP-related fields, and extending pipeline fixtures to cover the new subtype.
Changes:
- Add grok extraction for SNTP “Spurious.NTP packet rejected…”
LOG-4-Q_INDmessages, including socket id and source file/line. - Add
cisco.sntp.*fields to the integration’s field definitions and documentation. - Extend pipeline test fixtures with a sanitized SNTP example and expected output.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/cisco_aironet/manifest.yml | Bumps package version to 1.21.2. |
| packages/cisco_aironet/docs/README.md | Documents new cisco.sntp.* fields. |
| packages/cisco_aironet/data_stream/log/fields/aironet-fields.yml | Adds mappings for new cisco.sntp.* fields. |
| packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml | Adds SNTP source-context grok and extends Q_IND grok patterns. |
| packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log | Adds an SNTP LOG-4-Q_IND fixture line. |
| packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json | Adds expected output for SNTP fixture; also includes new fields on an existing Q_IND fixture. |
| packages/cisco_aironet/changelog.yml | Adds 1.21.2 changelog entry. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if: >- | ||
| ctx._temp_?.reason == 'DTL-4-ARP_ORPHANPKT_DETECTED' || | ||
| ctx._temp_?.reason == 'LOG-4-Q_IND' | ||
| patterns: | ||
| - "STA\\(Target MAC Address\\) \\[%{MAC:client.mac}.*?\\] %{DATA:event.reason}\\(Source IP Address\\) %{IP:client.ip}%{DATA}\\(Destination IP Address\\) %{IP:server.ip}" | ||
| - "Spurious\\.NTP packet rejected on socket %{INT:cisco.sntp.socket_id:int}" | ||
| ignore_failure: false |
| | cisco.sntp.socket_id | Socket identifier on which a spurious SNTP/NTP packet was rejected | integer | | ||
| | cisco.sntp.source_file | C source filename that generated the SNTP log entry | keyword | | ||
| | cisco.sntp.source_line | Line number in the C source file that generated the SNTP log entry | integer | |
| - name: cisco.sntp.socket_id | ||
| type: integer | ||
| description: Socket identifier on which a spurious SNTP/NTP packet was rejected | ||
| - name: cisco.sntp.source_file | ||
| type: keyword | ||
| description: C source filename that generated the SNTP log entry | ||
| - name: cisco.sntp.source_line | ||
| type: integer | ||
| description: Line number in the C source file that generated the SNTP log entry |
| - version: "1.21.2" | ||
| changes: | ||
| - description: Fix LOG-4-Q_IND grok processor to only match ARP subtype messages, preventing pipeline errors for non-ARP subtypes such as SNTP. | ||
| type: bugfix | ||
| link: https://github.com/elastic/integrations/pull/1 |
![vera-review-bot[bot]](https://avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
| tag: grok_sntp_source_context_a3f7c891 | ||
| description: LOG-4-Q_IND SNTP - extract source file and line from full_message before the field is stripped | ||
| field: _temp_.full_message | ||
| if: "ctx._temp_?.reason == 'LOG-4-Q_IND'" |
There was a problem hiding this comment.
Severity: 🟡 Medium confidence: high path: packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml:264
The new SNTP source-context grok fires on every LOG-4-Q_IND, so the pre-existing ARP-orphan event is mislabeled with cisco.sntp.* fields; gate the if on the SNTP message text.
Details
LOG-4-Q_IND is shared by two unrelated subtypes: the ARP-orphan message (...%LOG-4-Q_IND: [PA]dtl_net.c:3393 STA(Target MAC Address) ... ARP ..., test log line 1) and the SNTP spurious-packet message this PR adds. The new grok_sntp_source_context_a3f7c891 processor gates only on ctx._temp_?.reason == 'LOG-4-Q_IND', so it also matches the ARP event and writes cisco.sntp.source_file/cisco.sntp.source_line onto it. This is visible in the updated expected JSON, where the ARP event (@timestamp 2026-09-06T23:08:09.371+08:00, client.ip 169.254.161.111) now carries cisco.sntp.source_file: "[PA]dtl_net.c" and cisco.sntp.source_line: 3393. Those fields are documented as 'the SNTP log entry' source, so tagging a DTL/ARP event with them is an incorrect field mapping.
Recommendation:
Restrict the extraction to the actual SNTP subtype by adding a message-content guard so ARP-orphan events are not tagged with cisco.sntp.*.
| if: "ctx._temp_?.reason == 'LOG-4-Q_IND'" | |
| if: "ctx._temp_?.reason == 'LOG-4-Q_IND' && ctx.message != null && ctx.message.contains('Spurious.NTP packet rejected')" |
🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
| changes: | ||
| - description: Fix LOG-4-Q_IND grok processor to only match ARP subtype messages, preventing pipeline errors for non-ARP subtypes such as SNTP. | ||
| type: bugfix | ||
| link: https://github.com/elastic/integrations/pull/1 |
There was a problem hiding this comment.
Severity: 🟡 Medium confidence: high path: packages/cisco_aironet/changelog.yml:6
Changelog links a different PR number
Details
This changelog entry's link: points at pull/1, but it was added in PR #20923. It is likely a leftover template placeholder or a copy from another PR.
Recommendation:
Point each added changelog entry's link at this PR:
link: https://github.com/elastic/integrations/pull/20923🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
Niceplace
changed the title
|
✅ All changelog entries have the correct PR link. |
|
🟢 No issues across the latest commits b543140. Review summaryIssues found across earlier commits b090d75 — 2 medium
🤖 AI-Generated Review | Vera Review Bot - v0.2.7 | 📚 Knowledge base: integration-skills
|
💚 Build Succeeded
History
cc @Niceplace |
Executive summary
Expand strict Cisco Aironet parsing for ARP orphan and NTP packet rejection messages without routing on brittle message substrings.
The parser remains gated by Cisco reason values and keeps
ignore_failure: false. Supported reason/payload combinations are encoded directly in anchored grok patterns, so unsupported payloads and mismatched reason/payload families continue to reach the pipeline-level failure handler.Root cause
LOG-4-Q_INDis a shared reason used for multiple payload families. The existing strict grok only understood the ARP orphan format, so a valid NTP rejection event failed ingestion. An intermediate implementation added only the exactSpurious.NTPform and extracted SNTP source fields from everyLOG-4-Q_IND, which remained too narrow and mislabeled ARP events.Implementation
ignore_failure: false.message.contains(...).DTL-4-ARP_ORPHANPKT_DETECTEDandLOG-4-Q_INDcan parse ARP orphan payloads.LOG-4-Q_INDand canonicalSNTP-4-PKT_REJECTEDcan parse NTP rejection payloads.Spurious.NTP;incomprehensible NTP;NTP packet rejected;[...It occurred N times.!]suffixes.cisco.sntp.source_file,cisco.sntp.source_line, andcisco.sntp.socket_idonly for matching NTP rejection events.Test coverage
Added sanitized pipeline fixtures covering:
Spurious.NTP, arbitrary qualifier-dot, qualifier-space, and bare NTP forms.LOG-4-Q_INDand canonicalSNTP-4-PKT_REJECTEDreasons.All
*-expected.jsonchanges were generated with the pipeline test runner. Additional temporary mismatch cases confirmed that a DTL reason with an NTP payload and an SNTP reason with an ARP payload both produceevent.kind: pipeline_error; those cases are not committed because the pipeline test runner intentionally rejects documents containing pipeline errors.Validation
elastic-package format --fail-fastelastic-package lintelastic-package checkelastic-package test pipeline --data-streams log --generateelastic-package test pipeline --data-streams logAll validation passes on Elastic Stack 9.4.4.
References