Integration Name
System [packages/system]
Dataset Name
system.auth
Integration Version
2.20.0
Agent Version
8.15.5
Agent Output Type
logstash
Elasticsearch Version
9.3.3
OS Version and Architecture
linux, kubernetes
Software/API Version
NA
Error Message
No error message.
Event Original
Jul 1 10:56:50 host1 groupadd[3829308]: group added to /etc/gshadow: name=fleet
Jul 1 11:05:59 host1 groupdel[3870987]: group 'fleet' removed from /etc/gshadow
What did you do?
elastic agent -> logstash -> kafka -> logstash -> elasticsearch
What did you see?
Observed Behavior
group.name is missing in the parsed document despite the value being present in the raw log.
event.action is missing for both groupadd and groupdel events.
What did you expect to see?
Expected Behavior
The parser should extract and populate:
group.name: if its present
event.action: when its possible to add ( group-add or group_add
event.action: when its possible to add ( for eg. group-deletion or group_del )
Anything else?
No response
Integration Name
System [packages/system]
Dataset Name
system.auth
Integration Version
2.20.0
Agent Version
8.15.5
Agent Output Type
logstash
Elasticsearch Version
9.3.3
OS Version and Architecture
linux, kubernetes
Software/API Version
NA
Error Message
No error message.
Event Original
Jul 1 10:56:50 host1 groupadd[3829308]: group added to /etc/gshadow: name=fleet
Jul 1 11:05:59 host1 groupdel[3870987]: group 'fleet' removed from /etc/gshadow
What did you do?
elastic agent -> logstash -> kafka -> logstash -> elasticsearch
What did you see?
Observed Behavior
group.name is missing in the parsed document despite the value being present in the raw log.
event.action is missing for both groupadd and groupdel events.
What did you expect to see?
Expected Behavior
The parser should extract and populate:
group.name: if its present
event.action: when its possible to add ( group-add or group_add
event.action: when its possible to add ( for eg. group-deletion or group_del )
Anything else?
No response