Skip to content

[Infoblox NIOS] Update Grok pattern to handle the new log format - #17031

Merged
moxarth-rathod merged 2 commits into
elastic:mainfrom
moxarth-rathod:infoblox-grok-fix
Jan 28, 2026
Merged

moxarth-rathod merged 2 commits into
elastic:mainfrom
moxarth-rathod:infoblox-grok-fix

Conversation

@moxarth-rathod

@moxarth-rathod moxarth-rathod commented Jan 22, 2026 •

Copy link
Copy Markdown
Contributor

Proposed commit message

infoblox_nios: handle additional IP field in syslog format

The existing grok pattern failed to parse logs that include an extra IP 
address field between the priority and hostname. The updated pattern now 
captures this optional IP field and processes it alongside the existing 
host IP field.

Test logs were obtained from the reported issue.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

  • Clone integrations repo.
  • Install elastic package locally.
  • Start elastic stack using elastic-package.
  • Move to integrations/packages/infoblox_nios directory.
  • Run the following command to run tests.

elastic-package test

Related issues

@moxarth-rathod moxarth-rathod self-assigned this Jan 22, 2026
@moxarth-rathod
moxarth-rathod requested a review from a team as a code owner January 22, 2026 07:27
@moxarth-rathod moxarth-rathod added Integration:infoblox_nios Infoblox NIOS bugfix Pull request that fixes a bug issue Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] Team:SDE-Crest Crest developers on the Security Integrations team [elastic/sit-crest-contractors] labels Jan 22, 2026
@elasticmachine

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@efd6 efd6 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rémy suggests:

infoblox_nios: handle additional IP field in syslog format

The existing grok pattern failed to parse logs that include an extra IP 
address field between the priority and hostname. The updated pattern now 
captures this optional IP field and processes it alongside the existing 
host IP field.

[AUTHOR: Please add test data provenance - where did the new log sample come from?]

Comment thread packages/infoblox_nios/changelog.yml Outdated