Skip to content

[hpe_aruba_cx] Fix PROC_ID grok pattern to allow optional colon after PID bracket - #20765

Merged
mjwolf merged 7 commits into
elastic:mainfrom
mjwolf:aruba_cx_proc_id_fix
Aug 19, 2026
Merged

[hpe_aruba_cx] Fix PROC_ID grok pattern to allow optional colon after PID bracket#20765
mjwolf merged 7 commits into
elastic:mainfrom
mjwolf:aruba_cx_proc_id_fix

Conversation

@mjwolf

@mjwolf mjwolf commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Proposed commit message

Some ArubaOS-CX switches emit a space instead of ]: after the process ID, causing 100% parse failures. Making the colon optional fixes parsing for both variants while remaining backward compatible.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Related issues

@mjwolf @claude
[hpe_aruba_cx] Fix PROC_ID grok pattern to allow optional colon after…
ace4d78 
… PID bracket

Some ArubaOS-CX switches emit a space instead of ]: after the process
ID, causing 100% parse failures. Making the colon optional fixes parsing
for both variants while remaining backward compatible.

Closes elastic#18867

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@mjwolf
mjwolf requested a review from a team as a code owner August 17, 2026 22:15
@mjwolf mjwolf added bugfix Pull request that fixes a bug issue Integration:hpe_aruba_cx HPE Aruba CX Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Aug 17, 2026
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Aug 17, 2026

Copy link
Copy Markdown

Pinging @elastic/integration-experience (Team:Integration-Experience)

@github-actions

github-actions Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

vera-review-bot[bot]
vera-review-bot Bot reviewed Aug 17, 2026
View reviewed changes
Comment thread packages/hpe_aruba_cx/changelog.yml Outdated
@mjwolf
mjwolf enabled auto-merge (squash) August 17, 2026 23:02
vera-review-bot[bot]
vera-review-bot Bot reviewed Aug 17, 2026
View reviewed changes
Comment thread packages/hpe_aruba_cx/changelog.yml Outdated
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Aug 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

qcorporation
qcorporation reviewed Aug 19, 2026
View reviewed changes

@qcorporation qcorporation left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mjwolf can we do something about the suricata changes? the vera-bot also has called this out.

@mjwolf
mjwolf requested a review from qcorporation August 19, 2026 18:35
@mjwolf

mjwolf commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

@mjwolf can we do something about the suricata changes? the vera-bot also has called this out.

I've taken out those unintentional changes

@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@vera-review-bot

vera-review-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown

🟢 No issues across the latest commits 18498cd…cadad75 (16 commits).

Review summary

Issues found across earlier commits 13f7418…3d6e3fe (21 commits) — 1 critical

Package-level:

  • 🔴 This PR reverts the already-merged Suricata fix from PR 20665 (packages/suricata: manifest.yml, changelog.yml, data_stream/eve/elasticsearch/ingest_pipeline/tls.yml and two pipeline test fixtures)
Issues found across earlier commits a94d11f — 1 low
Issues found across earlier commits ace4d78 — 1 low
  • 🔵 The new 0.4.4 changelog entry links to issue 18867 instead of this PR (link) (Resolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.2.6 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Aug 19, 2026

Copy link
Copy Markdown

💚 Build Succeeded

History

@mjwolf
mjwolf merged commit 1a7384f into elastic:main Aug 19, 2026
9 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Package hpe_aruba_cx - 0.4.5 containing this change is available at https://epr.elastic.co/package/hpe_aruba_cx/0.4.5/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@qcorporation qcorporation qcorporation approved these changes
+1 more reviewer
@vera-review-bot vera-review-bot[bot] vera-review-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

bugfix Pull request that fixes a bug issue Integration:hpe_aruba_cx HPE Aruba CX Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[HPE Aruba CX] Integration fails to parse syslog messages - PROC_ID pattern doesn't match space-separated PID format

2 participants

@mjwolf @qcorporation