Fix sudo auth parsing without TTY

packages/system/changelog.yml

@@ -1,4 +1,9 @@
 # later versions go on top
+- version: "2.22.3"
+  changes:
+    - description: Fix parsing of sudo auth messages that omit the TTY field while preserving existing TTY and sudo error parsing.
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/20587
 - version: "2.22.2"
   changes:
     - description: Replace the hardcoded host link in the "[Metrics System] Overview" dashboard with a dashboard-to-dashboard drilldown, so navigation to "[Metrics System] Host Overview" works across Kibana Spaces (including after "Copy to Space").

packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log

@@ -0,0 +1 @@
+Aug  6 19:42:10 server01 sudo[18432]: alice : PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/id

packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-config.yml

@@ -0,0 +1,7 @@
+fields:
+  event:
+    timezone: "+0000"
+  input.type: log
+dynamic_fields:
+  "event.ingested": "^.*$"
+  "@timestamp": "^[0-9]{4}(-[0-9]{2}){2}T[0-9]{2}(:[0-9]{2}){2}\\.[0-9]{3}Z$"

packages/system/data_stream/auth/_dev/test/pipeline/test-sudo-no-tty.log-expected.json

@@ -0,0 +1,56 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2026-08-06T19:42:10.000Z",
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "category": [
+                    "process"
+                ],
+                "kind": "event",
+                "original": "Aug  6 19:42:10 server01 sudo[18432]: alice : PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/id",
+                "timezone": "+0000",
+                "type": [
+                    "start"
+                ]
+            },
+            "host": {
+                "hostname": "server01"
+            },
+            "input": {
+                "type": "log"
+            },
+            "message": "alice : PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/id",
+            "process": {
+                "name": "sudo",
+                "pid": 18432
+            },
+            "related": {
+                "hosts": [
+                    "server01"
+                ],
+                "user": [
+                    "alice",
+                    "root"
+                ]
+            },
+            "system": {
+                "auth": {
+                    "sudo": {
+                        "command": "/usr/bin/id",
+                        "pwd": "/home/alice",
+                        "user": "root"
+                    }
+                }
+            },
+            "user": {
+                "effective": {
+                    "name": "root"
+                },
+                "name": "alice"
+            }
+        }
+    ]
+}

packages/system/data_stream/auth/elasticsearch/ingest_pipeline/message.yml

@@ -18,7 +18,7 @@ processors:
         - '^%{DATA:system.auth.ssh.event} %{DATA:system.auth.ssh.method} for (invalid user)?%{DATA:user.name} from %{IPORHOST:source.address} port %{NUMBER:source.port:long} ssh2(: %{GREEDYDATA:system.auth.ssh.signature})?'
         - '^%{DATA:system.auth.ssh.event} user %{DATA:user.name} from %{IPORHOST:source.address}'
         - '^Did not receive identification string from %{IPORHOST:system.auth.ssh.dropped_ip}'
-        - '^%{DATA:user.name} :( %{DATA:system.auth.sudo.error} ;)? TTY=%{DATA:system.auth.sudo.tty} ; PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
+        - '^%{DATA:user.name} :(?: ((?!TTY=)%{DATA:system.auth.sudo.error}) ;)?(?: TTY=%{DATA:system.auth.sudo.tty} ;)? PWD=%{DATA:system.auth.sudo.pwd} ; USER=%{DATA:system.auth.sudo.user} ; COMMAND=%{GREEDYDATA:system.auth.sudo.command}'
         - '^new group: name=%{DATA:group.name}, GID=%{NUMBER:group.id}'
         - '^new user: name=%{DATA:user.target.name}, UID=%{NUMBER:user.target.id}, GID=%{NUMBER:group.id}, home=%{DATA:system.auth.useradd.home}, shell=%{DATA:system.auth.useradd.shell}$'
   - set:

packages/system/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: system
 title: System
-version: "2.22.2"
+version: "2.22.3"
 description: Collect system logs and metrics from your servers with Elastic Agent.
 type: integration
 categories: