[cisco_ftd] Fix grok for 111008/111009 to capture usernames with spaces.

[ie-ops]

Executive summary

The grok patterns for Cisco FTD message codes 111008 and 111009 used %{NOTSPACE} to capture the username field (server.user.name), which excludes whitespace and therefore fails to parse usernames containing spaces (e.g., service accounts like example-service account). The fix replaces %{NOTSPACE} with %{DATA} in both patterns, allowing the username to contain spaces while still being correctly bounded by the surrounding single quotes. A new pipeline test fixture was added to validate the space-containing username case, and the package version was bumped to 3.13.9.

Proposed commit message

[cisco_ftd] Fix grok for 111008/111009 to capture usernames with spaces.

Root cause

The grok_message_e6caac62 processor uses %{NOTSPACE:server.user.name} (regex \S+) to capture the username from 111008/111009 messages, which stops at the first whitespace character. Cisco FTD allows service accounts and domain accounts with embedded spaces in their names, causing the pattern to fail mid-match and the processor to throw a parse error.

Approach

In the grok_message_e6caac62 processor (which handles message IDs 111008 and 111009), replace %{NOTSPACE:server.user.name} with %{DATA:server.user.name} in both grok patterns. The username is already delimited on both sides by literal single-quote characters, so DATA (which matches any character including spaces) is safely bounded and will correctly capture multi-word usernames such as service accounts and domain accounts. Add a pipeline test fixture for the sanitized event to validate the corrected patterns. Bump package version from 3.13.4 to 3.13.5 with a bugfix changelog entry.

Implementation

1. Step 1: Edit packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml — in the grok_message_e6caac62 processor (line ~410), change pattern 1 from ^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments} to ^%{NOTSPACE} '%{DATA:server.user.name}' executed %{NOTSPACE} %{GREEDYDATA:_temp_.cisco.command_line_arguments}
2. Step 2: Edit packages/cisco_ftd/data_stream/log/elasticsearch/ingest_pipeline/default.yml — in the same grok_message_e6caac62 processor (line ~411), change pattern 2 from ^%{NOTSPACE} '%{NOTSPACE:server.user.name}' executed the '%{DATA}' command to ^%{NOTSPACE} '%{DATA:server.user.name}' executed the '%{DATA}' command
3. Step 3: Append the sanitized test event to packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log: <181>Jul 7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command.
4. Step 4: Update packages/cisco_ftd/data_stream/log/_dev/test/pipeline/test-ftd-fix.log-expected.json — add the expected output entry for the new event with server.user.name: "example-service account", event.code: "111008", _temp_.cisco.command_line_arguments: "show running-config zero-trust", and related.user containing "example-service account" (the existing append_related_user_6a92751c processor at line ~3104 already handles this append for server.user.name)
5. Step 5: Update packages/cisco_ftd/changelog.yml — prepend a new entry for version 3.13.5 with type: bugfix and description: Fix grok pattern for messages 111008 and 111009 to capture usernames containing spaces.
6. Step 6: Update packages/cisco_ftd/manifest.yml — bump version from 3.13.4 to 3.13.5
7. Step 7: Run elastic-package test pipeline --data-streams log from packages/cisco_ftd/ to validate all test fixtures pass

Pipeline changes

• grok_message_e6caac62, pattern 1: replace %{NOTSPACE:server.user.name} with %{DATA:server.user.name} — username is bounded by surrounding single-quote delimiters so DATA cannot over-capture
• grok_message_e6caac62, pattern 2: replace %{NOTSPACE:server.user.name} with %{DATA:server.user.name} — same bounding rationale applies

Field / mapping changes

—

Sanitized error message

[pipeline error]

Sanitized log (event_sanitized excerpt)

<181>Jul  7 14:12:01 198.51.100.10 %FTD-5-111008: User 'example-service account' executed the 'show running-config zero-trust' command.

Reviewer concerns

• The test fixture file (test-ftd-fix.log) is missing a trailing newline (\ No newline at end of file); minor style issue that some CI linters flag.
• The first grok pattern uses %{GREEDYDATA} for command_line_arguments after %{DATA} for the username — both rely on the single-quote delimiters being well-formed in the log message. If a username itself contained a literal single quote, DATA (non-greedy .*?) would stop at the first ' and potentially misparse; this edge case is unlikely in practice but worth noting.

Self-review findings

—

Risk and classification

• Plan risk level: low
• Tags: pipeline, processors, test-fixture, ingest
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: cisco_ftd.log [PIPELINE_FIX]: [pipeline error]
• Pipeline case: 394498904ab18c7a

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 6c6bbee