[Pulse Connect Secure] Authentication failure logs with "Short Password" cannot be parsed

[TaksinBo]

Integration Name

Pulse Connect Secure [packages/pulse_connect_secure]

Dataset Name

No response

Integration Version

2.6.1

Agent Version

8.19.18

Agent Output Type

elasticsearch

Elasticsearch Version

8.19.18

OS Version and Architecture

Red Hat Enterprise Linux 9.6 (Plow)

Software/API Version

No response

Error Message

The event fails during ingest pipeline processing with the following error:

Provided Grok expressions do not match field value:

<134>1 2026-08-02T09:39:14+07:00 vpn.example.com PulseSecure: - - - 2026-08-02 09:39:14 - ive - [198.51.100.10] Default Network::user123!([Example Authentication Realm])[][] - Login failed for 'Primary' authentication using auth server 'ldap.example.local' ('LDAP Server'). Reason: 'Short Password'

The event is not parsed and no ECS fields are extracted.

Event Original

<134>1 2026-08-02T09:39:14+07:00 vpn.example.com PulseSecure: - - - 2026-08-02 09:39:14 - ive - [198.51.100.10] Default Network::user123!([Example Authentication Realm])[][] - Login failed for 'Primary' authentication using auth server 'ldap.example.local' ('LDAP Server'). Reason: 'Short Password'

What did you do?

• Installed the Pulse Connect Secure integration using the default ingest pipeline.
• Configured the integration to receive RFC5424 Syslog messages.
• Enabled "Preserve original event".
• Sent authentication failure logs from Pulse Connect Secure.
• Verified that the event reached Elasticsearch but failed during Grok parsing.

What did you see?

The event was ingested but the ingest pipeline failed during Grok parsing.

The following error was returned:

Provided Grok expressions do not match field value

As a result:

• The event is not parsed correctly.
• ECS fields such as source.ip, user.name, event.action, and event.outcome are not extracted.
• The pipeline processing stops at the Grok processor.

What did you expect to see?

The authentication failure log should be parsed successfully.

Expected ECS fields include:

• source.ip
• user.name
• event.action
• event.outcome
• event.reason
• observer.type
• observer.product
• Authentication realm
• LDAP server name

The event should indicate a failed authentication with the reason:

Short Password

Anything else?

The issue appears to be related to the current Grok pattern not matching this valid Pulse Connect Secure authentication failure log.

Possible causes include:

• Username contains a ! character.
• Authentication realm contains spaces and parentheses.
• Empty optional fields are represented as [][].
• The log ends with:

Reason: 'Short Password'

The attached sample has been sanitized but preserves the original log structure.

If helpful, I can provide additional sanitized samples that exhibit the same parsing failure.