[cisco_ise] Fix NOTCOLON grok pattern to exclude spaces.

[ie-ops]

Executive summary

The fix addresses a null pointer error (cannot access method/field [normalizeIndex] from a null def reference) in the cisco_ise RADIUS Accounting pipeline. The root cause was that the NOTCOLON grok pattern ([^:]*?) used to capture cisco_ise.log.log_severity_level also matched strings containing spaces, causing RADIUS Accounting KV-format messages (which lack a traditional severity level prefix) to incorrectly match the first grok pattern instead of falling through to the segment-number pattern. A new SEVERITY_LEVEL pattern ([^: ]*?) is introduced that excludes both colons and spaces, ensuring only true severity level tokens (e.g. NOTICE, ERROR) match that capture group, while KV-only messages correctly fall through to the segment number pattern.

Proposed commit message

[cisco_ise] Fix NOTCOLON grok pattern to exclude spaces.

Root cause

The NOTCOLON custom pattern definition in the grok_message_details processor is '[^:]*?', which excludes only colons but permits spaces. When processing CISE_RADIUS_Accounting events whose _tmp.message begins with a numeric message-ID sequence (no leading severity token), Pattern 1 still matches by consuming the entire KV prefix up to the first in-band colon (e.g., RSSI: 32) as the severity level, since the lazy quantifier can stretch across spaces. This misparse corrupts the message field content, preventing the downstream KV processor from splitting the log details correctly.

Approach

In default.yml, the grok_message_details processor defines NOTCOLON: '[^:]*?', which allows spaces. This causes Pattern 1 (^%{NOTCOLON:log_severity_level}%{SPACE}: %{NOTCOLON:event.action}%{SPACE}: %{GREEDYDATA:message}$) to greedily match KV-pair content like NAS-Port-Type=Wireless - IEEE 802.11, Connect-Info=CONNECT 54.00 Mbps / 802.11ac / RSSI as the severity level when an unqualified RADIUS Accounting event arrives, because the colon in RSSI: 32 satisfies the pattern. The fix is to change the pattern definition to NOTCOLON: '[^: ]*?', excluding spaces so severity-level matches are constrained to single-word tokens (NOTICE, WARN, ERROR, etc.), allowing Pattern 2 (NUMBER-based) to correctly match RADIUS Accounting messages. A new pipeline test fixture is added using the sanitized event to verify the fix.

Implementation

1. Step 1: Edit packages/cisco_ise/data_stream/log/elasticsearch/ingest_pipeline/default.yml — in the grok_message_details processor's pattern_definitions block (line 38), change NOTCOLON: '[^:]*?' to NOTCOLON: '[^: ]*?' to exclude spaces from the character class.
2. Step 2: Append the sanitized event line to packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-accounting.log: <181>Jun 27 20:31:03 host-1.example.local CISE_RADIUS_Accounting 0043327910 2 1 NAS-Port-Type=Wireless - IEEE 802.11, Connect-Info=CONNECT 54.00 Mbps / 802.11ac / RSSI: 32 / Channel: 36, undefined-186=00-00-5E-00-53-01, undefined-187=00-00-5E-00-53-01, undefined-188=00-00-5E-00-53-02, AcsSessionID=host-1.example.local/552176388/39970818, SelectedAccessService=Wired 802.1X Access, RequestLatency=2, Step=11004, Step=11017, Step=15049, Step=15008, Step=22085, Step=11005, NetworkDeviceGroups=Location#All Locations#Decatur, NetworkDeviceGroups=Device Type#All Device Types#WLC, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, CPMSessionID=89a1d5c1-2b3e-4f67-8a9b-0c1d2e3f4a5b/eNGQyX2TavFi2t9dwQGLemzNIQQNutapUU, StepLatency=1=0\;2=0\;3=0\;4=1\;5=0, TotalAuthenLatency=2, ClientLatency=0, Network Device Profile=Cisco, Location=Location#All Locations#Decatur, Device Type=Device Type#All Device Types#WLC, IPSEC=IPSEC#Is IPSEC Device#No,
3. Step 3: Add the corresponding expected output entry to packages/cisco_ise/data_stream/log/_dev/test/pipeline/test-pipeline-radius-accounting.log-expected.json. The expected entry must show: cisco_ise.log.category.name=CISE_RADIUS_Accounting, cisco_ise.log.message.id=0043327910, cisco_ise.log.segment.total=2, cisco_ise.log.segment.number=1, cisco_ise.log.nas.port.type=Wireless - IEEE 802.11, cisco_ise.log.acs.session.id=host-1.example.local/552176388/39970818, cisco_ise.log.request.latency=2, cisco_ise.log.step=[11004,11017,15049,15008,22085,11005], cisco_ise.log.network.device.groups=[Location#All Locations#Decatur, Device Type#All Device Types#WLC, IPSEC#Is IPSEC Device#No], cisco_ise.log.selected.access.service=Wired 802.1X Access, with NO cisco_ise.log.log_severity_level or event.action fields set (those are only populated from the severity-prefixed message format).
4. Step 4: Update packages/cisco_ise/changelog.yml — prepend a new entry for version 1.32.7 with type: bugfix and description: Fix NOTCOLON grok pattern in default pipeline to exclude spaces, preventing RADIUS Accounting KV fields from being misidentified as log severity level.
5. Step 5: Update packages/cisco_ise/manifest.yml — bump version from 1.32.6 to 1.32.7.
6. Step 6: Run elastic-package test pipeline --data-streams log from packages/cisco_ise to validate all existing and new test cases pass.

Pipeline changes

• In default.yml, grok_message_details processor (line 38): change pattern_definitions entry NOTCOLON: '[^:]*?' to NOTCOLON: '[^: ]*?' — excludes space from the character class so that the severity-level capture group cannot span across whitespace-separated KV tokens

Field / mapping changes

—

Sanitized error message

cannot access method/field [normalizeIndex] from a null def reference

Sanitized log (event_sanitized excerpt)

<181>Jun 27 20:31:03 host-1.example.local CISE_RADIUS_Accounting 0043327910 2 1  NAS-Port-Type=Wireless - IEEE 802.11, Connect-Info=CONNECT 54.00 Mbps / 802.11ac / RSSI: 32 / Channel: 36, undefined-186=00-00-5E-00-53-01, undefined-187=00-00-5E-00-53-01, undefined-188=00-00-5E-00-53-02, AcsSessionID=host-1.example.local/552176388/39970818, SelectedAccessService=Wired 802.1X Access, RequestLatency=2, Step=11004, Step=11017, Step=15049, Step=15008, Step=22085, Step=11005, NetworkDeviceGroups=Location#All Locations#Decatur, NetworkDeviceGroups=Device Type#All Device Types#WLC, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, CPMSessionID=89a1d5c1-2b3e-4f67-8a9b-0c1d2e3f4a5b/eNGQyX2TavFi2t9dwQGLemzNIQQNutapUU, StepLatency=1=0\;2=0\;3=0\;4=1\;5=0, TotalAuthenLatency=2, ClientLatency=0, Network Device Profile=Cisco, Location=Location#All Locations#Decatur, Device Type=Device Type#All Device Types#WLC, IPSEC=IPSEC#Is IPSEC Device#No,

Reviewer concerns

• The NOTCOLON pattern is still used for event.action capture in the same pattern line; reviewers should verify that event action values never contain spaces in practice, though this is unchanged behavior.
• The new test fixture line uses syslog priority 181 (facility=22/local6, severity=5/notice), which maps to event.category: ["configuration"]; reviewers should confirm this categorization is correct for the added RADIUS Accounting message type.
• The expected output does not include a log_severity_level field for the new test case (the message has no severity prefix), which is correct but worth verifying explicitly in review.

Self-review findings

—

Risk and classification

• Plan risk level: medium
• Tags: pipeline, processors, ingest, test-fixture
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: cisco_ise.log [PIPELINE_FIX]: cannot access method/field [normalizeIndex] from a null def reference
• Pipeline case: dde207f6c73c92a9

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[vera-review-bot]

🟢 No issues across the latest commits 7d116e8.

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[taylor-swanson]

merge conflicts need to be resolved, otherwise lgtm

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: f8f16b6

History

• 💚 Build #47531 succeeded 7d116e8

cc @vinit-chauhan

[elastic-vault-github-plugin-prod]

Package cisco_ise - 1.32.13 containing this change is available at https://epr.elastic.co/package/cisco_ise/1.32.13/