[Infoblox NIOS] Update Grok pattern to handle the new log format - #17031
Merged
Merged
Conversation
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
Contributor
🚀 Benchmarks reportTo see the full report comment with |
efd6
reviewed
Jan 25, 2026
efd6
left a comment
Contributor
There was a problem hiding this comment.
Rémy suggests:
infoblox_nios: handle additional IP field in syslog format
The existing grok pattern failed to parse logs that include an extra IP
address field between the priority and hostname. The updated pattern now
captures this optional IP field and processes it alongside the existing
host IP field.
[AUTHOR: Please add test data provenance - where did the new log sample come from?]
Proposed commit message
Checklist
changelog.ymlfile.How to test this PR locally
Related issues