auditd: teach kv about quoted spaces

packages/auditd/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "3.4.2"
+ changes:
+ - description: Allow processing of messages with quoted spaces.
+ type: bugfix
+ link: https:/elastic/integrations/pull/4858
 - version: "3.4.1"
  changes:
  - description: Migrate the visualizations to by value in dashboards to minimize the saved object clutter and reduce time to load

packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log

@@ -44,3 +44,4 @@ type=BPRM_FCAPS msg=audit(1481077308.360:529): fver=0 fp=0000000000000000 fi=000
 type=SOCKADDR msg=audit(1481078424.953:688): saddr=02000050A9FEA9FE0000000000000000
 type=CKADDR msg=audit(1481078553.346:737): saddr=02000050A9FEA9FE0000000000000000
 type=DAEMON_END msg=audit(1481078697.892:7799): auditd normal halt, sending auid=? pid=? subj=? res=success
+type=ANOM_ABEND msg=audit(1605431420.026:123): auid=12345 uid=123 gid=123 ses=123456789 pid=1234 comm="extproc" reason="memory violation" sig=6

packages/auditd/data_stream/log/_dev/test/pipeline/test-auditd-raw.log-expected.json

@@ -1949,6 +1949,50 @@
  "tags": [
  "preserve_original_event"
  ]
+ },
+ {
+ "@timestamp": "2020-11-15T09:10:20.026Z",
+ "auditd": {
+ "log": {
+ "reason": "memory violation",
+ "record_type": "ANOM_ABEND",
+ "sequence": 123,
+ "ses": "123456789",
+ "sig": "6"
+ }
+ },
+ "ecs": {
+ "version": "8.5.0"
+ },
+ "event": {
+ "action": [
+ "crashed-program"
+ ],
+ "category": [
+ "process"
+ ],
+ "kind": "event",
+ "original": "type=ANOM_ABEND msg=audit(1605431420.026:123): auid=12345 uid=123 gid=123 ses=123456789 pid=1234 comm=\"extproc\" reason=\"memory violation\" sig=6",
+ "type": [
+ "end"
+ ]
+ },
+ "process": {
+ "name": "extproc",
+ "pid": 1234
+ },
+ "tags": [
+ "preserve_original_event"
+ ],
+ "user": {
+ "audit": {
+ "id": "12345"
+ },
+ "group": {
+ "id": "123"
+ },
+ "id": "123"
+ }
  }
  ]
 }

packages/auditd/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -26,8 +26,8 @@ processors:
  - "%{AUDIT_TYPE} %{AUDIT_KEY_VALUES:auditd.log.kv}"
  - kv:
  field: auditd.log.kv
- field_split: "\\s+"
- value_split: "="
+ field_split: '\s(?![\w\"]+?(\s+|$))'
+ value_split: '(?<!\\)='
  target_field: auditd.log
  - kv:
  field: auditd.log.sub_kv

packages/auditd/data_stream/log/fields/fields.yml

@@ -180,3 +180,5 @@
  type: keyword
  - name: reset
  type: keyword
+ - name: sig
+ type: keyword

packages/auditd/docs/README.md

@@ -153,6 +153,7 @@ An example event for `log` looks as following:
 | auditd.log.selected-context | | keyword |
 | auditd.log.sequence | The audit event sequence number. | long |
 | auditd.log.ses | | keyword |
+| auditd.log.sig | | keyword |
 | auditd.log.spid | | keyword |
 | auditd.log.src_prefixlen | | long |
 | auditd.log.subj | | keyword |

packages/auditd/manifest.yml

@@ -1,6 +1,6 @@
 name: auditd
 title: Auditd Logs
-version: "3.4.1"
+version: "3.4.2"
 release: ga
 description: Collect logs from Linux audit daemon with Elastic Agent.
 type: integration