Skip to content

fix(stirling-pdf-logs): add support for Stirling-PDF 2.9.2+ log format#1795

Draft
Copilot wants to merge 2 commits into
masterfrom
copilot/update-grok-pattern-compatibility
Draft

fix(stirling-pdf-logs): add support for Stirling-PDF 2.9.2+ log format#1795
Copilot wants to merge 2 commits into
masterfrom
copilot/update-grok-pattern-compatibility

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented May 12, 2026

Stirling-PDF 2.9.2+ changed the failed-login log format: the emitting class changed from CustomAuthenticationFailureHandler to AuthController, the level dropped from ERROR to WARN, and the message structure changed from Failed login attempt from IP: [X] to Invalid password for user: X from IP: Y.

Changes

  • parsers/s01-parse/crowdsecurity/stirling-pdf-logs.yaml: adds a second grok node alongside the existing one to match the new format, preserving backwards compatibility:
- grok:
    pattern: "%{TIMESTAMP_ISO8601:timestamp} %{WORD:log_level} %{DATA:logger} \\[%{DATA:thread}\\] Invalid password for user: %{DATA:username} from IP: %{IP:source_ip}"
    apply_on: message
  statics:
    - meta: log_type
      value: failed_authentication
  • .tests/stirling-pdf-logs/stirling-pdf.log: adds three new-format log samples (private IPs).
  • .tests/stirling-pdf-logs/parser.assert: updated to cover the 3 additional entries across all parser stages (s00-raw, s01-parse, s02-enrich).

Checklist

  • I have read the contributing guide
  • I have tested my changes locally
  • For new parsers or scenarios, tests have been added
  • I have run the hub linter and no issues were reported (see contributing guide)
  • Automated tests are passing
  • AI was used to generate any/all content of this PR

Copilot AI changed the title [WIP] Update grok pattern for Stirling-PDF logs compatibility fix(stirling-pdf-logs): add support for Stirling-PDF 2.9.2+ log format May 12, 2026
Copilot finished work on behalf of buixor May 12, 2026 08:51
Copilot AI requested a review from buixor May 12, 2026 08:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

crowdsecurity/stirling-pdf-logs | Since Stirling-PDF Version 2.9.2-fat grok Pattern does not match

2 participants