[cisco_aironet] Parse strict ARP and NTP rejection variants

[ie-ops]

Executive summary

Expand strict Cisco Aironet parsing for ARP orphan and NTP packet rejection messages without routing on brittle message substrings.

The parser remains gated by Cisco reason values and keeps ignore_failure: false. Supported reason/payload combinations are encoded directly in anchored grok patterns, so unsupported payloads and mismatched reason/payload families continue to reach the pipeline-level failure handler.

Root cause

LOG-4-Q_IND is a shared reason used for multiple payload families. The existing strict grok only understood the ARP orphan format, so a valid NTP rejection event failed ingestion. An intermediate implementation added only the exact Spurious.NTP form and extracted SNTP source fields from every LOG-4-Q_IND, which remained too narrow and mislabeled ARP events.

Implementation

• Keep strict parsing enabled with ignore_failure: false.
• Keep processor routing reason-based; do not use message.contains(...).
• Couple each supported reason to its payload family in the grok patterns:
  • DTL-4-ARP_ORPHANPKT_DETECTED and LOG-4-Q_IND can parse ARP orphan payloads.
  • LOG-4-Q_IND and canonical SNTP-4-PKT_REJECTED can parse NTP rejection payloads.
• Parse from the preserved full Cisco message so reason and payload are validated together.
• Support ARP repeated-message suffixes.
• Support NTP rejection variants with:
  • qualifier plus period, such as Spurious.NTP;
  • qualifier plus whitespace, such as incomprehensible NTP;
  • bare NTP packet rejected;
  • nonnegative socket IDs;
  • optional terminal periods;
  • optional [...It occurred N times.!] suffixes.
• Populate cisco.sntp.source_file, cisco.sntp.source_line, and cisco.sntp.socket_id only for matching NTP rejection events.
• Correct the changelog link and update the field documentation.

Test coverage

Added sanitized pipeline fixtures covering:

• ARP under both supported reasons, with and without the repeated-message suffix.
• Spurious.NTP, arbitrary qualifier-dot, qualifier-space, and bare NTP forms.
• LOG-4-Q_IND and canonical SNTP-4-PKT_REJECTED reasons.
• Terminal-period and repeated-message variants.

All *-expected.json changes were generated with the pipeline test runner. Additional temporary mismatch cases confirmed that a DTL reason with an NTP payload and an SNTP reason with an ARP payload both produce event.kind: pipeline_error; those cases are not committed because the pipeline test runner intentionally rejects documents containing pipeline errors.

Validation

• elastic-package format --fail-fast
• elastic-package lint
• elastic-package check
• elastic-package test pipeline --data-streams log --generate
• elastic-package test pipeline --data-streams log

All validation passes on Elastic Stack 9.4.4.

References

• Cisco Wireless LAN Controller System Message Guide: DTL and EAP system messages
• Cisco Wireless LAN Controller System Message Guide: SNTP system messages
• Cisco NTP troubleshooting documentation

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[Copilot]

Pull request overview

This PR updates the Cisco Aironet log ingest pipeline to handle LOG-4-Q_IND messages more safely by adding SNTP parsing support, adding new SNTP-related fields, and extending pipeline fixtures to cover the new subtype.

Changes:

• Add grok extraction for SNTP “Spurious.NTP packet rejected…” LOG-4-Q_IND messages, including socket id and source file/line.
• Add cisco.sntp.* fields to the integration’s field definitions and documentation.
• Extend pipeline test fixtures with a sanitized SNTP example and expected output.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/cisco_aironet/manifest.yml	Bumps package version to 1.21.2.
packages/cisco_aironet/docs/README.md	Documents new cisco.sntp.* fields.
packages/cisco_aironet/data_stream/log/fields/aironet-fields.yml	Adds mappings for new cisco.sntp.* fields.
packages/cisco_aironet/data_stream/log/elasticsearch/ingest_pipeline/default.yml	Adds SNTP source-context grok and extends Q_IND grok patterns.
packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log	Adds an SNTP LOG-4-Q_IND fixture line.
packages/cisco_aironet/data_stream/log/_dev/test/pipeline/test-aironet-messages.log-expected.json	Adds expected output for SNTP fixture; also includes new fields on an existing Q_IND fixture.
packages/cisco_aironet/changelog.yml	Adds 1.21.2 changelog entry.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[vera-review-bot]

🟢 No issues across the latest commits 0f931bf…93b8282 (18 commits).

Review summary

Issues found across earlier commits b090d75 — 2 medium

• 🟡 The new SNTP source-context grok fires on every LOG-4-Q_IND, so the pre-existing ARP-orphan event is mislabeled with cisco.sntp.* fields (link) (Unresolved)
• 🟡 Changelog links a different PR number (link) (Unresolved)

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.3.0 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 93b8282

History

• 💚 Build #48700 succeeded b543140
• 💔 Build #48606 failed b090d75
• 💔 Build #48603 failed 83f21d4

cc @Niceplace