[fortinet_fortigate] Fix grok pattern for plain-word login sources. - #19935

Executive summary

The fix addresses a missing case where login messages with plain word identifiers (like 'fgfm_fgc') were failing to parse. The grok pattern in the 'ssh login 3' processor has been updated to make the IP-in-parentheses part optional using (?:\(%{IP:source.ip}\))?, allowing it to match both traditional formats like 'ssh(172.16.200.254)' and plain word formats like 'fgfm_fgc'. A test case has been added to verify the fix works correctly, and all tests pass.

Proposed commit message

[fortinet_fortigate] Fix grok pattern for plain-word login sources.

Root cause

The grok pattern in the 'ssh login 3' processor (line 81 of login.yml) expects the source identifier to match either 'jsconsole' or 'WORD(IP)' format. FortiOS emits events with the source as 'fgfm_fgc' (FortiClient Flexible Communication), which is just a plain word without parentheses, causing the pattern to fail and log an error.

Approach

Update the grok pattern in the 'ssh login 3' processor to accept plain word identifiers (like 'fgfm_fgc') in addition to the existing 'jsconsole' literal and 'WORD(IP)' formats. Make the IP in parentheses optional to accommodate FortiOS variants where the source is specified without an IP.

Implementation

1. Step 1: Modify the grok pattern in packages/fortinet_fortigate/data_stream/log/elasticsearch/ingest_pipeline/login.yml at line 81. Change the source-matching portion from '(?:jsconsole|%{WORD}(%{IP:source.ip}))' to '(?:jsconsole|%{WORD}(?:(%{IP:source.ip}))?)', making the IP in parentheses optional.
2. Step 2: Add a test case to packages/fortinet_fortigate/data_stream/log/_dev/test/pipeline/test-fortinet-7-4.log with the sanitized event containing 'from fgfm_fgc' to ensure this variant is covered by pipeline tests.
3. Step 3: Generate the expected output for the new test case by running the pipeline against the new event and validating that 'event.outcome' and 'user.name' are correctly extracted, with source.ip coming from the 'srcip' field if available.

Pipeline changes

• Modify grok pattern in 'ssh login 3' processor (line 81) to make IP in parentheses optional: change '(?:jsconsole|%{WORD}(%{IP:source.ip}))' to '(?:jsconsole|%{WORD}(?:(%{IP:source.ip}))?)'. This allows matching plain word identifiers like 'fgfm_fgc' without an IP in parentheses, while preserving extraction of IPs in formats like 'ssh(172.16.200.254)'.

Field / mapping changes

—

Sanitized error message

Processor grok with tag ssh login 3 in pipeline logs-fortinet_fortigate.log-login failed with message: [on_failure_message]

Sanitized log (event_sanitized excerpt)

<190>date=2026-06-27 time=02:37:26 devname="example-device" devid="FG000000000001" eventtime=1782542246278949972 tz="-0400" logid="0100032001" type="event" subtype="system" level="information" vd="root" logdesc="Admin login successful" sn="1782542246" user="alice.johnson" ui="fgfm_fgc" method="fgfm_fgc" srcip=internal dstip=internal action="login" status="success" reason="none" profile="super_admin" msg="Administrator alice.johnson logged in successfully from fgfm_fgc"

Reviewer concerns

For plain word identifiers without parentheses, the source.ip field won't be captured from the message parsing itself—though the raw srcip field is still available. The pattern is now more permissive, but the preceding if condition should filter most false positives.

Self-review findings

—

Risk and classification

• Plan risk level: low
• Tags: pipeline, processors, ingest, test-fixture
• Impact: medium

Links

• Issue: (no issue number)
• Issue title: fortinet_fortigate.log [MISSING_CASE]: Processor grok with tag ssh login 3 in pipeline logs-fortinet_fortigate.…
• Pipeline case: b93a164fb897c665