[citrix_waf] Support RFC5424 syslog header for NetScaler NS14.1+#19891
Merged
Conversation
ilyannn
force-pushed
the
citrix_waf-rfc5424-support
branch
from
a581986 to
b2bd593
Compare
Contributor
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
ilyannn
added
enhancement
Contributor
🚀 Benchmarks reportTo see the full report comment with |
ilyannn
force-pushed
the
citrix_waf-rfc5424-support
branch
2 times, most recently
from
da3c4e9 to
c5090d4
Compare
NetScaler NS14.1 and later prepend an RFC5424 syslog header to both CEF
and native messages over TCP/UDP, which the pipeline never stripped. The
whole <PRI>VER ... envelope leaked into citrix.detail, so grok_citrix_detail
failed, and CEF events were mis-routed to the native sub-pipeline because the
<PRI>VER prefix defeats the startsWith("CEF:") check.
- default.yml: parse the RFC5424 envelope with the standard SYSLOG5424BASE /
SYSLOG5424PRI grok building blocks (matching symantec_endpoint, fortinet,
etc.), capturing log.syslog.{priority,version,hostname,appname,procid,msgid}
and the envelope timestamp -> @timestamp, and surfacing the appliance
hostname as observer.hostname. Stripping the envelope lets the existing
CEF/native routing work.
- native.yml: make the NetScaler header optional and reconstruct
citrix.device_event_class_id from the RFC5424 APP-NAME (log.syslog.appname)
for native bodies that omit the module token. Classic NS10/NS11 parsing is
unchanged.
- Declare the log.syslog.* ECS fields and add NS14.1 pipeline test fixtures
(CEF + native).
Relates to elastic/sdh-beats#7312.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
ilyannn
force-pushed
the
citrix_waf-rfc5424-support
branch
from
c5090d4 to
9fa0951
Compare
|
Pinging @elastic/integration-experience (Team:Integration-Experience) |
|
No issues across the latest commits 9fa0951.
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
Contributor
|
✅ All changelog entries have the correct PR link. |
💚 Build Succeeded
History
cc @ilyannn |
andrewkroh
added
the
documentation
haetamoudi
approved these changes
Jul 2, 2026
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
Contributor
|
Package citrix_waf - 1.21.0 containing this change is available at https://epr.elastic.co/package/citrix_waf/1.21.0/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What / why
NetScaler NS14.1 and later, when sending syslog over TCP/UDP, prepend an RFC5424 syslog header to both CEF and native App Firewall messages (e.g.
<134>1 2026-06-22T14:34:06Z host APPFW 0-PPE-3 - - CEF:0|...). Thecitrix_wafpipeline never stripped this envelope, so:<PRI>VER …header leaked intocitrix.detail, andgrok_citrix_detail_21fa0653failed with "Provided Grok expressions do not match field value";<134>1prefix defeats thectx.citrix.detail.startsWith("CEF:")routing check.The shipped test fixtures only cover NS10/NS11 BSD-syslog framing (EOL), so this went undetected.
Changes
default.yml: add an RFC5424 envelope pattern to the entry grok that strips the header so the existing CEF/native routing works, mapping the envelope timestamp →@timestampand the appliance hostname →observer.hostname. The RFC5424APP-NAMEis carried via a_tmpfield for native reconstruction.native.yml: make the NetScaler native header optional, and for native bodies that omit the leading module token (the module now lives in RFC5424APP-NAME) reconstructcitrix.device_event_class_idfrom the carriedAPP-NAME. Classic NS10/NS11 native parsing is unchanged (the two paths areif-gated).test-citrix-waf-rfc5424.log) covering both CEF and native, with fully synthetic values.cef.ymlis unchanged — once the envelope is stripped, the existing CEF dissect/KV handling works as-is.Testing
elastic-package test pipeline— all pass; existing CEF/native expected outputs are byte-for-byte unchanged.pipeline_error/error.message): correct@timestampfrom the envelope,observer.hostnameset,citrix.device_event_class_idreconstructed, native fields and CEFsource.ip/port/KV fields populated, no leftover_tmp.*keys.elastic-package lintandelastic-package checkpass.