[ie-ops]

Executive summary

A new grok pattern '^%{SHARED}, Content: %{DATA:message}$' is added to the QNAP NAS ingest pipeline to handle event log entries that omit the Application: and Category: fields (e.g., system-internal log archive notifications). Previously, such messages fell through all existing patterns and caused the grok processor to emit a MISSING_CASE failure. The fix adds the pattern in the correct position — after the Application/Category pattern so it does not shadow it — and includes a matching test fixture and expected output. The package version is bumped to 1.26.0.

Proposed commit message

[qnap_nas] Fix event log grok for entries without Application/Category.

Root cause

The grok processor grok__tmp_message_c75b80dc has two patterns that both require either Application: ... Category: ... or Connection type: ... after the shared prefix, but some QNAP system-internal events (e.g. log archive notifications generated by the System user) emit event log lines that skip those fields and jump directly to , Content: ..., causing both patterns to fail.

Approach

Add a third grok pattern to the processor tagged grok__tmp_message_c75b80dc (default.yml line 62) to handle event log messages that omit the Application and Category fields entirely, going straight from the SHARED block to ', Content: ...'. The new pattern is: ^%{SHARED}, Content: %{DATA:message}$. Place it as the third pattern (after the existing Application/Category pattern and before the conn-log pattern would be confused — it only applies to event-log provider, so there is no cross-type risk). The existing Painless script already handles the case where event.action is null and event.provider is event-log by setting category=configuration and type=change, so no script change is needed. Add the sanitized event as a new pipeline test fixture entry with the expected output reflecting the configuration/change ECS categorisation.

Implementation

1. Step 1: In packages/qnap_nas/data_stream/log/elasticsearch/ingest_pipeline/default.yml, add a third grok pattern inside processor grok__tmp_message_c75b80dc (currently at line 62–71): '^%{SHARED}, Content: %{DATA:message}$'. Insert it as the third entry in the patterns list, after the existing event-log Application/Category pattern.
2. Step 2: Verify that the existing Painless script (tag script_1d15b5b0) already covers the new case: when event.action == null and event.provider == 'event-log' it sets category=['configuration'] and type='change' — no change needed to the script.
3. Step 3: Append the sanitized event to packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log: <30>Jun 27 07:09:00 host-1.example.local qlogd[8212]: event log: Users: System, Source IP: 127.0.0.1, Computer name: host-1.example.local, Content: System Connection Logs archived to backup/example-backup-001.csv
4. Step 4: Append the corresponding expected document to packages/qnap_nas/data_stream/log/_dev/test/pipeline/test-event.log-expected.json. Expected fields: event.provider='event-log', event.kind='event', event.category=['configuration'], event.type='change', message='System Connection Logs archived to backup/example-backup-001.csv', user.name='System', related.user=['System'], host.name='host-1.example.local', process.name='qlogd', process.pid=8212, log.syslog.priority=30, observer.* fields, no source.ip (127.0.0.1 is excluded by the SHARED pattern), no qnap.nas.application, no qnap.nas.category, tags=['preserve_original_event'].
5. Step 5: Add a changelog entry to packages/qnap_nas/changelog.yml as a new 1.25.4 version with type bugfix describing support for event log entries without Application and Category fields.
6. Step 6: Run elastic-package test pipeline -C packages/qnap_nas to verify all pipeline tests pass including the new fixture entry.

Pipeline changes

• Add third grok pattern to processor grok__tmp_message_c75b80dc in default.yml: '^%{SHARED}, Content: %{DATA:message}$' — placed after the existing Application/Category event-log pattern as a fallback for system-internal event log entries that omit those fields

Field / mapping changes

—

Sanitized error message

Processor 'grok' with tag 'grok__tmp_message_c75b80dc' in pipeline 'logs-qnap_nas.log-default' failed with message '[on_failure_message]'

Sanitized log (event_sanitized excerpt)

<30>Jun 27 07:09:00 host-1.example.local qlogd[8212]: event log: Users: System, Source IP: 127.0.0.1, Computer name: host-1.example.local, Content: System Connection Logs archived to backup/example-backup-001.csv

Reviewer concerns

• The event.category: ["configuration"] and event.type: "change" values in the expected output for the new test case imply the pipeline's ECS categorization logic assigns a non-trivial default when qnap.nas.application and qnap.nas.category are absent; reviewers should trace that logic in the full pipeline YAML to confirm the assignment is intentional and correct.
• The changelog link: value is https://github.com/elastic/integrations/pull/1 (a placeholder); it must be updated with the real PR number before merging.
• Pattern order is load-bearing: the new pattern must remain between the Application/Category pattern and the Connection-type pattern; any future reordering of the patterns list could cause regressions.

Self-review findings

Self-review invoked: yes (1 cycle)

Severity	Finding	Addressed
major	Placeholder PR link #1 in changelog.yml flagged as invalid by reviewer The placeholder link is explicitly required by the fix harness instructions: 'The link field must use the placeholder #1. Do NOT fabricate a real-looking PR number. The placeholder will be updated to the actual PR URL after the PR is created.' This is an intentional convention, not a defect.	⚠️

Final validation passed: yes

Risk and classification

• Plan risk level: medium
• Tags: pipeline, processors, ingest, test-fixture
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: qnap_nas.log [MISSING_CASE]: Processor 'grok' with tag 'grok__tmp_message_c75b80dc' in pipeline 'logs…
• Pipeline case: 9f09390664cb6f25

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 8eb69cc

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[vera-review-bot]

No issues across the latest commits 8eb69cc.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

Package qnap_nas - 1.26.0 containing this change is available at https://epr.elastic.co/package/qnap_nas/1.26.0/