[cisco_aironet] Fix date parsing for year-present, no-ms timestamps.

[ie-ops]

Executive summary

Adds the MMM d yyyy HH:mm:ss date format to the raw_date_processor in the cisco_aironet ingest pipeline. IOS-XE WLC devices can emit syslog timestamps that include a four-digit year but omit millisecond precision (e.g., Jun 27 2026 05:32:54 EDT). The pipeline already handled the year-with-milliseconds variant (MMM d yyyy HH:mm:ss.SSS) but had no fallback for the no-milliseconds case, causing the date processor to raise a MISSING_CASE failure. Adding the new format directly below the existing year-aware pattern closes the gap.

Proposed commit message

[cisco_aironet] Fix date parsing for year-present, no-ms timestamps.

Root cause

The 'raw_date_processor' date processor in default.yml only declares formats with milliseconds ('MMM d yyyy HH:mm:ss.SSS', 'MMM d HH:mm:ss.SSS') or without year and without milliseconds ('MMM d HH:mm:ss'), so a valid IOS-XE WLC Format 3 timestamp that carries a year but lacks milliseconds (e.g. 'Jun 27 2026 05:32:54') matches none of the declared formats and causes the processor to fail.

Approach

Add the missing format strings 'MMM d yyyy HH:mm:ss' and 'MMM d HH:mm:ss' to the 'raw_date_processor' date processor in default.yml. These handle the year-present/millisecond-absent variant (e.g. 'Jun 27 2026 05:32:54') and the year-absent/millisecond-absent variant respectively, placed after their millisecond-bearing counterparts so the more-specific pattern wins. Also add a test fixture line for the sanitized event and a corresponding expected output entry.

Implementation

1. Step 1: In packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml, add 'MMM d yyyy HH:mm:ss' immediately after the existing 'MMM d yyyy HH:mm:ss.SSS' entry in the 'raw_date_processor' date processor's formats list (line ~125).
2. Step 2: In the same date processor, add 'MMM d HH:mm:ss' after the existing 'MMM d HH:mm:ss.SSS' entry to cover the no-year/no-millisecond variant (already present per line 127 inspection — verify; if missing, add it).
3. Step 3: Append the sanitized test event '<190>3393587: host-1.example.local: 3394483: Jun 27 2026 05:32:54 EDT: %SEC-6-IPACCESSLOGP: list vlan100-20240101000000 permitted tcp 198.51.100.10(49814) -> 203.0.113.20(443), 1 packet' to packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log.
4. Step 4: Add the corresponding expected output object to packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json, verifying @timestamp is parsed correctly (2026-06-27T09:32:54.000Z for EDT=UTC-4) and event fields are populated.
5. Step 5: Run 'elastic-package test pipeline' against the cisco_aironet package to confirm the new fixture passes and no existing fixtures regress.
6. Step 6: Bump the version in packages/cisco_aironet/changelog.yml with a 'bugfix' entry and a patch version bump (1.21.1 → 1.21.2, or next available patch).

Pipeline changes

• In the 'raw_date_processor' date processor, add format 'MMM d yyyy HH:mm:ss' after 'MMM d yyyy HH:mm:ss.SSS' to handle year-present, millisecond-absent timestamps.
• In the 'raw_date_processor' date processor, verify 'MMM d HH:mm:ss' is present (after 'MMM d HH:mm:ss.SSS') to handle year-absent, millisecond-absent timestamps; add if missing.

Field / mapping changes

—

Sanitized error message

Processor 'date' with tag 'raw_date_processor' in pipeline 'logs-cisco_aironet.log-default' failed with message '[on_failure_message]'

Sanitized log (event_sanitized excerpt)

<190>3393587: host-1.example.local: 3394483: Jun 27 2026 05:32:54 EDT: %SEC-6-IPACCESSLOGP: list vlan100-20240101000000 permitted tcp 198.51.100.10(49814) -> 203.0.113.20(443), 1 packet

Reviewer concerns

• The expected @timestamp in the new fixture is 2026-06-27T05:32:54.000+08:00 even though the raw log contains EDT (UTC-4). This is consistent with the pipeline's design — timezone resolution uses _conf.tz_offset rather than the timezone token captured by grok — but reviewers should confirm the test's tz_offset config is set to +08:00 and that this behaviour matches production expectations.
• The new format is inserted between the year+ms and the no-year+ms patterns; ordering is correct (most-specific first) and will not accidentally shadow existing formats.

Self-review findings

—

Risk and classification

• Plan risk level: low
• Tags: pipeline, processors, test-fixture, ingest
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: cisco_aironet.log [MISSING_CASE]: Processor 'date' with tag 'raw_date_processor' in pipeline 'logs-cisco_a…
• Pipeline case: 12f5e5087f3b5d34

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 0504ae5

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[vera-review-bot]

Severity: 🟡 Medium confidence: medium path: packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log:42

The new %SEC-6-IPACCESSLOGP fixture is ingested with its ACL body completely unparsed - no source.ip, destination.ip, ports, network.transport or cisco.acl.* - because the pipeline only handles the FMANFP-6- variant. Add a grok branch for SEC-6-IPACCESSLOGP.

Details

The added fixture line produces _temp_.reason == 'SEC-6-IPACCESSLOGP'. Every ACL grok in the pipeline is gated on the IOS-XE variants only (grok_FMANFP_IPACCESSLOGP at default.yml:354 requires ctx._temp_?.reason == 'FMANFP-6-IPACCESSLOGP', plus the NP/DP equivalents), so no branch matches. The generated expectation at test-aironet-messages.log-expected.json:1603-1633 confirms this: the event carries only message, event.provider/action/severity, host.name and syslog metadata - the source/destination addresses, ports, transport and ACL name present in the raw line are dropped. This PR now ships a committed sample of a classic IOS %SEC-6-IPACCESSLOGP ACL message that the package cannot enrich, and the ACL name in it (vlan100-20240101000000) plus the RFC 5737 addresses show the message body is well-formed and parseable.

Recommendation:

Add a handler for the SEC-6- form alongside the existing FMANFP-6-IPACCESSLOGP grok in default.yml, and regenerate test-aironet-messages.log-expected.json so the new event carries the ACL fields:

  ###
  - grok:
      tag: grok_SEC_IPACCESSLOGP
      description: SEC-6-IPACCESSLOGP
      field: message
      if: ctx._temp_?.reason == 'SEC-6-IPACCESSLOGP'
      patterns:
        - "list %{DATA:cisco.acl.name} %{WORD:cisco.acl.action} %{WORD:network.transport} %{IP:source.ip}\\(%{INT:source.port:int}\\) -> %{IP:destination.ip}\\(%{INT:destination.port:int}\\), %{INT} packets?"
      ignore_failure: false

If enriching this message type is out of scope for a date-parsing bugfix, use a fixture whose body the pipeline already parses (for example an FMANFP-6-IPACCESSLOGP line) so the committed test data does not document an unhandled message type.

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[vera-review-bot]

Severity: 🔵 Low confidence: medium path: packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json:1605

This expected @​timestamp value is never actually compared - test-common-config.yml lists @​timestamp under dynamic_fields, so the test only checks the shape yyyy-MM-ddTHH:mm:ss.SSS, not that the in-log year was honoured. Put the year-bearing sample in its own fixture with a -config.yml that omits the @​timestamp dynamic field.

Details

_dev/test/pipeline/test-common-config.yml:1-2 declares dynamic_fields: "@​timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}". Fields listed there are validated against the regex instead of being compared to the expected value, so 2026-06-27T05:32:54.000+08:00 is asserted only as 'some ISO-8601 timestamp with milliseconds'. That regex is necessary for the year-less lines in this fixture (their year defaults to the ingest year and changes over time), but it also means the one behaviour this PR fixes - honouring an in-log year - is not locked in: a result that silently fell back to the current year would still pass. The test does catch the original failure (without the added format the date processor throws and the event gains error.message/event.kind: pipeline_error), but it cannot detect a wrong parsed instant. Two further details make the expectation hard to read: the raw line says EDT, yet _conf.tz_offset is pre-set by the agent template (udp.yml.hbs:17-18, tz_offset default UTC) and both set__conf_tz_offset_* processors use override: false, so the in-log zone is discarded and the value is rendered in Asia/Singapore from the test config.

Recommendation:

Move the year-bearing sample into a dedicated fixture with its own config that does not mark @​timestamp dynamic, so the parsed instant is compared exactly:

# packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-year-timestamps.log-config.yml
fields:
  tags:
    - preserve_original_event
  _conf:
    tz_offset: "Asia/Singapore"

A per-file <fixture>-config.yml takes precedence over test-common-config.yml, so the other fixtures keep the dynamic @​timestamp they need. Consider also dropping the misleading EDT token from the sample (or using SGT, matching the configured zone) so the fixture and its expected offset agree.

---

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[vera-review-bot]

Review summary

Issues found across the latest commits 0504ae5 — 1 medium, 1 low

• 🟡 The new %SEC-6-IPACCESSLOGP fixture is ingested with its ACL body completely unparsed - no source.ip, destination.ip, ports, network.transport or cisco.acl.* - because the pipeline only handles the FMANFP-6- variant. Add a grok branch for SEC-6-IPACCESSLOGP. (link) (Unresolved)
• 🔵 This expected @​timestamp value is never actually compared - test-common-config.yml lists @​timestamp under dynamic_fields, so the test only checks the shape yyyy-MM-ddTHH:mm:ss.SSS, not that the in-log year was honoured. Put the year-bearing sample in its own fixture with a -config.yml that omits the @​timestamp dynamic field. (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.