diff --git a/packages/vsphere/changelog.yml b/packages/vsphere/changelog.yml index e7645a19c76..51346dc1428 100644 --- a/packages/vsphere/changelog.yml +++ b/packages/vsphere/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.24.2" + changes: + - description: Fix parsing of sshd `Connection closed` messages with no content after the port number in the log ingest pipeline. + type: bugfix + link: https://github.com/elastic/integrations/pull/20319 - version: "1.24.1" changes: - description: 'Parse space-separated vSphere log timestamps (for example: `2026-06-03 14:19:27.782`) in the log ingest pipeline.' diff --git a/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log b/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log index f2849430345..aaecd4967a4 100644 --- a/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log +++ b/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log @@ -163,3 +163,4 @@ <14>1 2026-06-03 14:19:27.782+0530 ncprd-vc01 vcenter-server: User prdexmgt@10.210.25.11 logged out (login time: Wednesday, 03 June, 2026 02:19:27 PM, number of API invocations: 1, user agent: Apache-CXF/3.6.6) <14>1 2026-06-03 14:19:27+05:30 ncprd-vc01 vcenter-server: User prdexmgt@10.210.25.11 logged out (login time: Wednesday, 03 June, 2026 02:19:27 PM, number of API invocations: 1, user agent: Apache-CXF/3.6.6) <14>1 2026-06-03 14:19:27+0530 ncprd-vc01 vcenter-server: User prdexmgt@10.210.25.11 logged out (login time: Wednesday, 03 June, 2026 02:19:27 PM, number of API invocations: 1, user agent: Apache-CXF/3.6.6) +<86>1 2026-06-17T01:58:38.817583+00:00 VCENTER sshd 619607 - - Connection closed by 10.93.10.123 port 58030 \ No newline at end of file diff --git a/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log-expected.json b/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log-expected.json index 89c91da313c..d4d14b48046 100644 --- a/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log-expected.json +++ b/packages/vsphere/data_stream/log/_dev/test/pipeline/test-format-common.log-expected.json @@ -112,6 +112,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -126,14 +134,6 @@ "name": "Go-http-client", "original": "Go-http-client/1.1", "version": "1.1" - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -183,6 +183,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -204,14 +212,6 @@ "invocations": 3 } } - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -258,6 +258,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -272,14 +280,6 @@ "name": "Go-http-client", "original": "Go-http-client/1.1", "version": "1.1" - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -329,6 +329,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -350,14 +358,6 @@ "invocations": 3 } } - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -404,6 +404,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -418,14 +426,6 @@ "name": "Go-http-client", "original": "Go-http-client/1.1", "version": "1.1" - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -475,6 +475,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -496,14 +504,6 @@ "invocations": 3 } } - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -550,6 +550,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -564,14 +572,6 @@ "name": "Go-http-client", "original": "Go-http-client/1.1", "version": "1.1" - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -621,6 +621,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -642,14 +650,6 @@ "invocations": 3 } } - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -942,6 +942,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -956,14 +964,6 @@ "name": "Go-http-client", "original": "Go-http-client/1.1", "version": "1.1" - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -1013,6 +1013,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -1034,14 +1042,6 @@ "invocations": 3 } } - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -1088,6 +1088,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -1102,14 +1110,6 @@ "name": "Go-http-client", "original": "Go-http-client/1.1", "version": "1.1" - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -1159,6 +1159,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -1180,14 +1188,6 @@ "invocations": 3 } } - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -2869,6 +2869,14 @@ "name": "vpxd", "pid": 24962 }, + "related": { + "ip": [ + "127.0.0.1" + ] + }, + "source": { + "ip": "127.0.0.1" + }, "tags": [ "preserve_original_event" ], @@ -2881,14 +2889,6 @@ }, "name": "Other", "original": "VMware-client/6.5.0" - }, - "source": { - "ip": "127.0.0.1" - }, - "related": { - "ip": [ - "127.0.0.1" - ] } }, { @@ -3824,6 +3824,14 @@ "process": { "name": "Hostd" }, + "related": { + "ip": [ + "192.168.0.1" + ] + }, + "source": { + "ip": "192.168.0.1" + }, "tags": [ "preserve_original_event" ], @@ -3833,14 +3841,6 @@ "path": "/var/log/vlf-ts" } } - }, - "source": { - "ip": "192.168.0.1" - }, - "related": { - "ip": [ - "192.168.0.1" - ] } }, { @@ -3886,17 +3886,17 @@ "name": "sshd", "pid": 12345 }, - "tags": [ - "preserve_original_event" - ], - "source": { - "ip": "192.168.1.1" - }, "related": { "ip": [ "192.168.1.1" ] - } + }, + "source": { + "ip": "192.168.1.1" + }, + "tags": [ + "preserve_original_event" + ] }, { "@timestamp": "2023-08-30T00:05:00.598Z", @@ -3938,17 +3938,17 @@ "name": "sshd", "pid": 12345 }, - "tags": [ - "preserve_original_event" - ], - "source": { - "ip": "192.168.1.1" - }, "related": { "ip": [ "192.168.1.1" ] - } + }, + "source": { + "ip": "192.168.1.1" + }, + "tags": [ + "preserve_original_event" + ] }, { "@timestamp": "2023-08-30T00:53:53.082Z", @@ -3990,17 +3990,17 @@ "name": "sshd", "pid": 12345 }, - "tags": [ - "preserve_original_event" - ], - "source": { - "ip": "192.168.1.1" - }, "related": { "ip": [ "192.168.1.1" ] - } + }, + "source": { + "ip": "192.168.1.1" + }, + "tags": [ + "preserve_original_event" + ] }, { "@timestamp": "2023-08-30T01:12:31.431Z", @@ -4045,6 +4045,14 @@ "name": "vpxd", "pid": 51038 }, + "related": { + "ip": [ + "192.168.1.1" + ] + }, + "source": { + "ip": "192.168.1.1" + }, "tags": [ "preserve_original_event" ], @@ -4054,14 +4062,6 @@ "path": "/var/log/vlf-ts" } } - }, - "source": { - "ip": "192.168.1.1" - }, - "related": { - "ip": [ - "192.168.1.1" - ] } }, { @@ -5693,6 +5693,14 @@ "process": { "name": "Hostd" }, + "related": { + "ip": [ + "192.168.0.1" + ] + }, + "source": { + "ip": "192.168.0.1" + }, "tags": [ "preserve_original_event" ], @@ -5712,14 +5720,6 @@ "invocations": 0 } } - }, - "source": { - "ip": "192.168.0.1" - }, - "related": { - "ip": [ - "192.168.0.1" - ] } }, { @@ -5762,6 +5762,14 @@ "process": { "name": "Hostd" }, + "related": { + "ip": [ + "192.168.0.1" + ] + }, + "source": { + "ip": "192.168.0.1" + }, "tags": [ "preserve_original_event" ], @@ -5774,14 +5782,6 @@ }, "name": "Other", "original": "VMware-client/6.5.0" - }, - "source": { - "ip": "192.168.0.1" - }, - "related": { - "ip": [ - "192.168.0.1" - ] } }, { @@ -5950,19 +5950,19 @@ "name": "vpxd", "pid": 6225 }, + "related": { + "ip": [ + "192.168.11.1" + ] + }, + "source": { + "ip": "192.168.11.1" + }, "tags": [ "preserve_original_event" ], "user": { "name": "philipp" - }, - "source": { - "ip": "192.168.11.1" - }, - "related": { - "ip": [ - "192.168.11.1" - ] } }, { @@ -6012,6 +6012,14 @@ "name": "vpxd", "pid": 58650 }, + "related": { + "ip": [ + "10.100.10.190" + ] + }, + "source": { + "ip": "10.100.10.190" + }, "tags": [ "preserve_original_event" ], @@ -6033,14 +6041,6 @@ "invocations": 75133 } } - }, - "source": { - "ip": "10.100.10.190" - }, - "related": { - "ip": [ - "10.100.10.190" - ] } }, { @@ -6083,6 +6083,14 @@ "process": { "name": "Hostd" }, + "related": { + "ip": [ + "192.168.0.1" + ] + }, + "source": { + "ip": "192.168.0.1" + }, "tags": [ "preserve_original_event" ], @@ -6095,14 +6103,6 @@ }, "name": "Other", "original": "VMware-client/6.5.0" - }, - "source": { - "ip": "192.168.0.1" - }, - "related": { - "ip": [ - "192.168.0.1" - ] } }, { @@ -6297,6 +6297,14 @@ "process": { "name": "fluentd" }, + "related": { + "ip": [ + "192.168.0.1" + ] + }, + "source": { + "ip": "192.168.0.1" + }, "tags": [ "preserve_original_event" ], @@ -6309,14 +6317,6 @@ }, "name": "Other", "original": "VMware-client/6.5.0" - }, - "source": { - "ip": "192.168.0.1" - }, - "related": { - "ip": [ - "192.168.0.1" - ] } }, { @@ -6395,6 +6395,14 @@ "process": { "name": "vcenter-server" }, + "related": { + "ip": [ + "10.210.25.11" + ] + }, + "source": { + "ip": "10.210.25.11" + }, "tags": [ "preserve_original_event" ], @@ -6414,14 +6422,6 @@ "invocations": 1 } } - }, - "source": { - "ip": "10.210.25.11" - }, - "related": { - "ip": [ - "10.210.25.11" - ] } }, { @@ -6467,6 +6467,14 @@ "process": { "name": "vcenter-server" }, + "related": { + "ip": [ + "10.210.25.11" + ] + }, + "source": { + "ip": "10.210.25.11" + }, "tags": [ "preserve_original_event" ], @@ -6486,14 +6494,6 @@ "invocations": 1 } } - }, - "source": { - "ip": "10.210.25.11" - }, - "related": { - "ip": [ - "10.210.25.11" - ] } }, { @@ -6539,6 +6539,14 @@ "process": { "name": "vcenter-server" }, + "related": { + "ip": [ + "10.210.25.11" + ] + }, + "source": { + "ip": "10.210.25.11" + }, "tags": [ "preserve_original_event" ], @@ -6558,14 +6566,6 @@ "invocations": 1 } } - }, - "source": { - "ip": "10.210.25.11" - }, - "related": { - "ip": [ - "10.210.25.11" - ] } }, { @@ -6611,6 +6611,14 @@ "process": { "name": "vcenter-server" }, + "related": { + "ip": [ + "10.210.25.11" + ] + }, + "source": { + "ip": "10.210.25.11" + }, "tags": [ "preserve_original_event" ], @@ -6630,14 +6638,6 @@ "invocations": 1 } } - }, - "source": { - "ip": "10.210.25.11" - }, - "related": { - "ip": [ - "10.210.25.11" - ] } }, { @@ -6683,6 +6683,14 @@ "process": { "name": "vcenter-server" }, + "related": { + "ip": [ + "10.210.25.11" + ] + }, + "source": { + "ip": "10.210.25.11" + }, "tags": [ "preserve_original_event" ], @@ -6702,14 +6710,6 @@ "invocations": 1 } } - }, - "source": { - "ip": "10.210.25.11" - }, - "related": { - "ip": [ - "10.210.25.11" - ] } }, { @@ -6755,6 +6755,14 @@ "process": { "name": "vcenter-server" }, + "related": { + "ip": [ + "10.210.25.11" + ] + }, + "source": { + "ip": "10.210.25.11" + }, "tags": [ "preserve_original_event" ], @@ -6774,15 +6782,59 @@ "invocations": 1 } } + } + }, + { + "@timestamp": "2026-06-17T01:58:38.817Z", + "client": { + "ip": "10.93.10.123", + "port": 58030 }, - "source": { - "ip": "10.210.25.11" + "ecs": { + "version": "8.11.0" + }, + "event": { + "category": [ + "authentication" + ], + "kind": "event", + "original": "<86>1 2026-06-17T01:58:38.817583+00:00 VCENTER sshd 619607 - - Connection closed by 10.93.10.123 port 58030", + "type": [ + "info" + ] + }, + "host": { + "name": "VCENTER" + }, + "log": { + "syslog": { + "facility": { + "code": 10, + "name": "Security" + }, + "priority": 86, + "severity": { + "code": 6, + "name": "Informational" + } + } + }, + "message": "Connection closed by 10.93.10.123 port 58030", + "process": { + "name": "sshd", + "pid": 619607 }, "related": { "ip": [ - "10.210.25.11" + "10.93.10.123" ] - } + }, + "source": { + "ip": "10.93.10.123" + }, + "tags": [ + "preserve_original_event" + ] } ] } diff --git a/packages/vsphere/data_stream/log/elasticsearch/ingest_pipeline/login.yml b/packages/vsphere/data_stream/log/elasticsearch/ingest_pipeline/login.yml index cd6c03e3b53..b55b52f885c 100644 --- a/packages/vsphere/data_stream/log/elasticsearch/ingest_pipeline/login.yml +++ b/packages/vsphere/data_stream/log/elasticsearch/ingest_pipeline/login.yml @@ -66,9 +66,10 @@ processors: pattern: "%{_tmp.status} from %{client.ip} port %{client.port} %{}" if: 'ctx.message?.startsWith(''Disconnected'') ?: false' description: Disconnect messages -- dissect: +- grok: field: message - pattern: Connection %{_tmp.status} by %{client.ip} port %{client.port} %{} + patterns: + - 'Connection %{DATA:_tmp.status} by %{IPORHOST:client.ip} port %{POSINT:client.port}( %{GREEDYDATA})?$' if: 'ctx.message?.startsWith(''Connection'') ?: false' description: Connection messages - dissect: diff --git a/packages/vsphere/manifest.yml b/packages/vsphere/manifest.yml index 6579b4c7255..774b071ae0f 100644 --- a/packages/vsphere/manifest.yml +++ b/packages/vsphere/manifest.yml @@ -1,7 +1,7 @@ title: VMware vSphere format_version: "3.0.2" name: vsphere -version: "1.24.1" +version: "1.24.2" description: This Elastic integration collects metrics and logs from vSphere/vCenter servers type: integration categories: