Syslog reader/processor does not handle escaped brackets in structured data fields

[taylor-swanson]

The syslog reader/processor does not properly handle escaped brackets (]) in the structured data fields of an RFC 5424 message.

Example log which triggers the issue:

<165>1 2003-10-11T22:14:15.003Z mymachine.example.com evntslog - ID47 [exampleSDID@32473 iut="3" eventSource="Application" eventID="1011" somekey="[value\] more data"][examplePriority@32473 class="high"] Some message

Expected raw structured data value:

[exampleSDID@32473 iut="3" eventSource="Application" eventID="1011" somekey="[value\] more data"][examplePriority@32473 class="high"]

Actual raw structured data value:

more data"][examplePriority@32473 class="high"]

The extraction of the values into a map also has to be updated to handle escaped characters.

• Discuss Forum URL: https://discuss.elastic.co/t/bug-syslog-rfc-5424-parser-does-not-properly-handle-escaped-characters-in-structured-data/364483

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)