@oneuptime/common 12.0.28 → 12.0.29

package/Utils/Grok/Grok.ts

@@ -0,0 +1,461 @@
+import BadDataException from "../../Types/Exception/BadDataException";
+import GrokPatterns from "./GrokPatterns";
+
+/*
+ * Grok engine.
+ *
+ * A grok pattern is a regex with named references into a pattern
+ * library: `%{IPV4:client_ip} - %{WORD:verb}` means "the IPv4 regex,
+ * captured as client_ip, then a literal ' - ', then a word captured as
+ * verb". Anything that is not a `%{...}` reference is passed through to
+ * the regex verbatim, so raw regex and grok references can be mixed.
+ *
+ * Supported reference forms:
+ *
+ *   %{NAME}              match, capture nothing
+ *   %{NAME:field}        capture into `field` as a string
+ *   %{NAME:field:type}   capture into `field`, coerced (int/float/boolean)
+ *
+ * Compilation expands references recursively into one JavaScript RegExp
+ * and records, for each captured field, the internal group name that
+ * holds it. Only the groups this engine injects capture — every library
+ * definition uses `(?:...)` — so extraction is a `match.groups` lookup
+ * with no index arithmetic.
+ *
+ * Matching is deliberately UNANCHORED, like Logstash: a pattern
+ * describes a fragment of the line unless the author anchors it with
+ * `^`/`$` themselves.
+ *
+ * This runs once per ingested log record on the telemetry hot path
+ * against text the customer's users control, so the compiler enforces
+ * hard ceilings on expansion (depth, count, final source length) and
+ * the matcher refuses inputs above MAX_GROK_INPUT_LENGTH rather than
+ * handing an unbounded string to a backtracking engine.
+ */
+
+export enum GrokFieldType {
+  String = "string",
+  Integer = "integer",
+  Float = "float",
+  Boolean = "boolean",
+}
+
+export type GrokValue = string | number | boolean;
+
+export interface GrokCapture {
+  /** Internal RegExp group name, e.g. "oug0". Never surfaced to users. */
+  groupName: string;
+  /** Attribute name the user asked for, e.g. "client_ip". */
+  fieldName: string;
+  fieldType: GrokFieldType;
+}
+
+export interface CompiledGrokPattern {
+  regex: RegExp;
+  captures: Array<GrokCapture>;
+  /** Expanded regex source. Useful for debugging and for the UI tester. */
+  source: string;
+}
+
+/** Longest raw pattern a user may save. */
+export const MAX_GROK_PATTERN_LENGTH: number = 4000;
+
+/** Longest expanded regex source a pattern may compile to. */
+export const MAX_GROK_SOURCE_LENGTH: number = 20000;
+
+/** How deep `%{A}` -> `%{B}` -> `%{C}` nesting may go. */
+export const MAX_GROK_EXPANSION_DEPTH: number = 20;
+
+/** Total number of references expanded while compiling one pattern. */
+export const MAX_GROK_EXPANSIONS: number = 500;
+
+/** Fields one pattern may capture. */
+export const MAX_GROK_CAPTURES: number = 100;
+
+/*
+ * Inputs longer than this are not parsed. A backtracking regex cannot be
+ * interrupted once started, so the only bound available on the ingest
+ * hot path is the length of what we feed it.
+ */
+export const MAX_GROK_INPUT_LENGTH: number = 32768;
+
+/*
+ * `%{NAME}`, `%{NAME:field}` or `%{NAME:field:type}`. The field and type
+ * segments exclude `{`, `}` and `:` so a malformed reference fails to
+ * match here and is reported as unparsable rather than being silently
+ * split at the wrong colon.
+ */
+const GROK_REFERENCE_SOURCE: string =
+  "%\\{([A-Za-z0-9_]+)(?::([^:{}]*))?(?::([^:{}]*))?\\}";
+
+/*
+ * Field names become log attribute keys. Dots are allowed because OTel
+ * semantic-convention keys use them (`http.request.method`).
+ */
+const FIELD_NAME_REGEX: RegExp = /^[A-Za-z_][A-Za-z0-9_.@-]*$/;
+
+interface CompileContext {
+  patterns: Record<string, string>;
+  captures: Array<GrokCapture>;
+  /** Names currently being expanded — used to reject circular references. */
+  stack: Array<string>;
+  expansions: number;
+}
+
+function parseFieldType(rawType: string | undefined): GrokFieldType {
+  if (!rawType) {
+    return GrokFieldType.String;
+  }
+
+  switch (rawType.trim().toLowerCase()) {
+    case "int":
+    case "integer":
+    case "long":
+      return GrokFieldType.Integer;
+    case "float":
+    case "double":
+    case "number":
+      return GrokFieldType.Float;
+    case "bool":
+    case "boolean":
+      return GrokFieldType.Boolean;
+    case "string":
+    case "text":
+      return GrokFieldType.String;
+    default:
+      throw new BadDataException(
+        `Unknown grok field type "${rawType}". Supported types are: int, long, float, double, boolean, string.`,
+      );
+  }
+}
+
+function resolveReference(
+  match: RegExpExecArray,
+  context: CompileContext,
+): string {
+  const patternName: string = match[1] as string;
+  const rawFieldName: string | undefined = match[2];
+  const rawFieldType: string | undefined = match[3];
+
+  context.expansions++;
+
+  if (context.expansions > MAX_GROK_EXPANSIONS) {
+    throw new BadDataException(
+      `This grok pattern expands to more than ${MAX_GROK_EXPANSIONS} sub-patterns. Please simplify it.`,
+    );
+  }
+
+  const definition: string | undefined = context.patterns[patternName];
+
+  if (definition === undefined) {
+    throw new BadDataException(
+      `Unknown grok pattern "%{${patternName}}". Check the list of supported patterns.`,
+    );
+  }
+
+  if (context.stack.includes(patternName)) {
+    throw new BadDataException(
+      `Grok pattern "%{${patternName}}" refers to itself. Circular pattern references are not supported.`,
+    );
+  }
+
+  if (context.stack.length >= MAX_GROK_EXPANSION_DEPTH) {
+    throw new BadDataException(
+      `Grok pattern "%{${patternName}}" nests more than ${MAX_GROK_EXPANSION_DEPTH} levels deep. Please simplify it.`,
+    );
+  }
+
+  context.stack.push(patternName);
+  const expanded: string = expandPattern(definition, context);
+  context.stack.pop();
+
+  if (rawFieldName === undefined) {
+    return `(?:${expanded})`;
+  }
+
+  const fieldName: string = rawFieldName.trim();
+
+  if (!FIELD_NAME_REGEX.test(fieldName)) {
+    throw new BadDataException(
+      `"${rawFieldName}" is not a valid grok field name. Use letters, digits, and . _ - @ (starting with a letter or underscore).`,
+    );
+  }
+
+  if (context.captures.length >= MAX_GROK_CAPTURES) {
+    throw new BadDataException(
+      `This grok pattern captures more than ${MAX_GROK_CAPTURES} fields. Please capture fewer fields.`,
+    );
+  }
+
+  const groupName: string = `oug${context.captures.length}`;
+
+  context.captures.push({
+    groupName: groupName,
+    fieldName: fieldName,
+    fieldType: parseFieldType(rawFieldType),
+  });
+
+  return `(?<${groupName}>${expanded})`;
+}
+
+function expandPattern(source: string, context: CompileContext): string {
+  /*
+   * A fresh RegExp per call: `lastIndex` is per-object state and
+   * expansion recurses, so a shared instance would have nested calls
+   * stepping on each other's scan position.
+   */
+  const referenceRegex: RegExp = new RegExp(GROK_REFERENCE_SOURCE, "g");
+
+  let output: string = "";
+  let cursor: number = 0;
+  let match: RegExpExecArray | null = referenceRegex.exec(source);
+
+  while (match !== null) {
+    output += source.slice(cursor, match.index);
+    output += resolveReference(match, context);
+    cursor = match.index + match[0].length;
+
+    if (output.length > MAX_GROK_SOURCE_LENGTH) {
+      throw new BadDataException(
+        `This grok pattern expands to more than ${MAX_GROK_SOURCE_LENGTH} characters of regex. Please simplify it.`,
+      );
+    }
+
+    match = referenceRegex.exec(source);
+  }
+
+  output += source.slice(cursor);
+
+  return output;
+}
+
+/*
+ * Compile a grok pattern. Throws BadDataException with a message meant
+ * for the person who typed the pattern — this is what save-time
+ * validation and the pattern tester in the dashboard show.
+ */
+export function compileGrokPattern(
+  pattern: string,
+  extraPatterns?: Record<string, string> | undefined,
+): CompiledGrokPattern {
+  if (typeof pattern !== "string" || pattern.trim().length === 0) {
+    throw new BadDataException("Grok pattern cannot be empty.");
+  }
+
+  if (pattern.length > MAX_GROK_PATTERN_LENGTH) {
+    throw new BadDataException(
+      `Grok pattern cannot be longer than ${MAX_GROK_PATTERN_LENGTH} characters.`,
+    );
+  }
+
+  const context: CompileContext = {
+    patterns: extraPatterns
+      ? { ...GrokPatterns, ...extraPatterns }
+      : GrokPatterns,
+    captures: [],
+    stack: [],
+    expansions: 0,
+  };
+
+  const source: string = expandPattern(pattern, context);
+
+  if (source.length > MAX_GROK_SOURCE_LENGTH) {
+    throw new BadDataException(
+      `This grok pattern expands to more than ${MAX_GROK_SOURCE_LENGTH} characters of regex. Please simplify it.`,
+    );
+  }
+
+  let regex: RegExp;
+
+  try {
+    /*
+     * No `g`/`y` flag on purpose: those carry `lastIndex` between calls
+     * and a compiled pattern is reused for every record.
+     */
+    regex = new RegExp(source);
+  } catch (err) {
+    throw new BadDataException(
+      `This grok pattern is not valid: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+
+  return {
+    regex: regex,
+    captures: context.captures,
+    source: source,
+  };
+}
+
+function coerceValue(raw: string, fieldType: GrokFieldType): GrokValue {
+  if (fieldType === GrokFieldType.Integer) {
+    const parsed: number = parseInt(raw, 10);
+    return Number.isFinite(parsed) ? parsed : raw;
+  }
+
+  if (fieldType === GrokFieldType.Float) {
+    const parsed: number = parseFloat(raw);
+    return Number.isFinite(parsed) ? parsed : raw;
+  }
+
+  if (fieldType === GrokFieldType.Boolean) {
+    const normalized: string = raw.trim().toLowerCase();
+
+    if (
+      normalized === "true" ||
+      normalized === "yes" ||
+      normalized === "y" ||
+      normalized === "1"
+    ) {
+      return true;
+    }
+
+    if (
+      normalized === "false" ||
+      normalized === "no" ||
+      normalized === "n" ||
+      normalized === "0"
+    ) {
+      return false;
+    }
+
+    /*
+     * Not recognisably a boolean — keep the raw text rather than
+     * inventing a `false` the log never said.
+     */
+    return raw;
+  }
+
+  return raw;
+}
+
+/*
+ * Run a compiled pattern against one string. Returns null when the
+ * pattern does not match; returns the captured fields otherwise (which
+ * is an empty object for a pattern that matches but captures nothing).
+ *
+ * Empty captures are dropped, matching Logstash's default
+ * `keep_empty_captures => false`: an optional group that did not
+ * participate should not write a blank attribute onto the log.
+ */
+export function matchGrokPattern(
+  compiled: CompiledGrokPattern,
+  input: string,
+): Record<string, GrokValue> | null {
+  if (typeof input !== "string" || input.length === 0) {
+    return null;
+  }
+
+  if (input.length > MAX_GROK_INPUT_LENGTH) {
+    return null;
+  }
+
+  const match: RegExpExecArray | null = compiled.regex.exec(input);
+
+  if (!match) {
+    return null;
+  }
+
+  const groups: Record<string, string | undefined> = match.groups || {};
+  const extracted: Record<string, GrokValue> = {};
+
+  for (const capture of compiled.captures) {
+    const raw: string | undefined = groups[capture.groupName];
+
+    if (raw === undefined || raw === "") {
+      continue;
+    }
+
+    /*
+     * The same field name can legitimately appear twice (alternation
+     * branches, or a library pattern that already names it). Whichever
+     * group actually matched first wins, so a later branch that did not
+     * participate cannot blank out a real value.
+     */
+    if (extracted[capture.fieldName] !== undefined) {
+      continue;
+    }
+
+    extracted[capture.fieldName] = coerceValue(raw, capture.fieldType);
+  }
+
+  return extracted;
+}
+
+/*
+ * Process-wide compile cache for the ingest path.
+ *
+ * Compiling walks the pattern library and builds a RegExp; doing that
+ * per log record would dominate the cost of the processor. Compiled
+ * patterns are immutable and carry no `lastIndex` state (no `g` flag),
+ * so one instance is safely shared by every project using the same
+ * pattern text.
+ *
+ * Failures are cached too. An invalid pattern that reaches ingest would
+ * otherwise be recompiled — and rejected — once per record.
+ */
+const compileCache: Map<string, CompiledGrokPattern | BadDataException> =
+  new Map<string, CompiledGrokPattern | BadDataException>();
+
+export const MAX_CACHED_GROK_PATTERNS: number = 500;
+
+export function compileGrokPatternCached(pattern: string): CompiledGrokPattern {
+  const cached: CompiledGrokPattern | BadDataException | undefined =
+    compileCache.get(pattern);
+
+  if (cached !== undefined) {
+    if (cached instanceof BadDataException) {
+      throw cached;
+    }
+
+    return cached;
+  }
+
+  let result: CompiledGrokPattern | BadDataException;
+
+  try {
+    result = compileGrokPattern(pattern);
+  } catch (err) {
+    result =
+      err instanceof BadDataException ? err : new BadDataException(String(err));
+  }
+
+  if (compileCache.size >= MAX_CACHED_GROK_PATTERNS) {
+    // Insertion-ordered: drop the oldest entry to bound the cache.
+    const oldestKey: string | undefined = compileCache.keys().next().value;
+
+    if (oldestKey !== undefined) {
+      compileCache.delete(oldestKey);
+    }
+  }
+
+  compileCache.set(pattern, result);
+
+  if (result instanceof BadDataException) {
+    throw result;
+  }
+
+  return result;
+}
+
+/** Test seam: forget every cached compilation. */
+export function clearGrokCompileCache(): void {
+  compileCache.clear();
+}
+
+/*
+ * Compile + match in one call. Convenience for the dashboard's pattern
+ * tester and for tests; ingest compiles once and reuses the result.
+ */
+export function parseWithGrokPattern(
+  pattern: string,
+  input: string,
+): Record<string, GrokValue> | null {
+  return matchGrokPattern(compileGrokPattern(pattern), input);
+}
+
+export default {
+  compileGrokPattern,
+  compileGrokPatternCached,
+  matchGrokPattern,
+  parseWithGrokPattern,
+};

package/Utils/Grok/GrokPatterns.ts

@@ -0,0 +1,118 @@
+/*
+ * Built-in grok pattern library.
+ *
+ * Grok is regex with names: `%{IPV4:client_ip}` is just the IPv4 regex
+ * plus "put what it matched in client_ip". This file holds the named
+ * regex halves; Grok.ts does the naming.
+ *
+ * Two rules every entry here must follow:
+ *
+ *   1. NO capturing groups. Use `(?:...)`. Grok.ts injects its own
+ *      named groups around the pattern it is asked to capture and reads
+ *      results back through `match.groups`, so a stray `(...)` in a
+ *      definition would silently shift nothing but still cost a capture
+ *      slot on every record.
+ *
+ *   2. JavaScript-compatible syntax only. The upstream Logstash
+ *      definitions are Oniguruma and use possessive quantifiers (`++`)
+ *      and atomic groups (`(?>...)`), neither of which V8 accepts —
+ *      those have been rewritten here rather than copied.
+ *
+ * Every repetition of a group consumes at least one character, which is
+ * what keeps `(?:/[\w]*)+`-shaped patterns linear instead of
+ * exponential. Keep it that way when adding patterns: these run once
+ * per ingested log record against attacker-supplied text.
+ */
+
+const GrokPatterns: Record<string, string> = {
+  /* --- Primitives --- */
+  USERNAME: String.raw`[a-zA-Z0-9._-]+`,
+  USER: String.raw`%{USERNAME}`,
+  INT: String.raw`(?:[+-]?(?:[0-9]+))`,
+  BASE10NUM: String.raw`(?:[+-]?(?:[0-9]+(?:\.[0-9]+)?|\.[0-9]+))`,
+  NUMBER: String.raw`(?:%{BASE10NUM})`,
+  BASE16NUM: String.raw`(?:0[xX])?(?:[0-9A-Fa-f]+)`,
+  POSINT: String.raw`\b(?:[1-9][0-9]*)\b`,
+  NONNEGINT: String.raw`\b(?:[0-9]+)\b`,
+  WORD: String.raw`\b\w+\b`,
+  NOTSPACE: String.raw`\S+`,
+  SPACE: String.raw`\s*`,
+  DATA: String.raw`.*?`,
+  GREEDYDATA: String.raw`.*`,
+  QUOTEDSTRING: String.raw`(?:"(?:\\.|[^\\"])*"|'(?:\\.|[^\\'])*')`,
+  QS: String.raw`%{QUOTEDSTRING}`,
+  UUID: String.raw`[A-Fa-f0-9]{8}-(?:[A-Fa-f0-9]{4}-){3}[A-Fa-f0-9]{12}`,
+
+  /* --- Network --- */
+  IPV4: String.raw`(?<![0-9])(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?![0-9])`,
+  /*
+   * Alternation is first-match, not longest-match, so order carries
+   * meaning here: the IPv4-embedded forms come first (a generic hex form
+   * would otherwise stop before the dotted quad), and the "::"-elision
+   * forms are ordered so a shape that can only match a prefix never sits
+   * ahead of one that matches the whole address.
+   */
+  IPV6: String.raw`(?:::(?:[Ff]{4}(?::0{1,4})?:)?%{IPV4}|(?:[0-9A-Fa-f]{1,4}:){1,4}:%{IPV4}|(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|[0-9A-Fa-f]{1,4}:(?::[0-9A-Fa-f]{1,4}){1,6}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))`,
+  IP: String.raw`(?:%{IPV6}|%{IPV4})`,
+  HOSTNAME: String.raw`\b(?:[0-9A-Za-z][0-9A-Za-z-]{0,62})(?:\.(?:[0-9A-Za-z][0-9A-Za-z-]{0,62}))*\.?`,
+  IPORHOST: String.raw`(?:%{IP}|%{HOSTNAME})`,
+  HOSTPORT: String.raw`%{IPORHOST}:%{POSINT}`,
+  COMMONMAC: String.raw`(?:(?:[A-Fa-f0-9]{2}:){5}[A-Fa-f0-9]{2})`,
+  CISCOMAC: String.raw`(?:(?:[A-Fa-f0-9]{4}\.){2}[A-Fa-f0-9]{4})`,
+  WINDOWSMAC: String.raw`(?:(?:[A-Fa-f0-9]{2}-){5}[A-Fa-f0-9]{2})`,
+  MAC: String.raw`(?:%{CISCOMAC}|%{WINDOWSMAC}|%{COMMONMAC})`,
+  EMAILLOCALPART: String.raw`[a-zA-Z0-9!#$%&'*+\-/=?^_{|}~]{1,64}(?:\.[a-zA-Z0-9!#$%&'*+\-/=?^_{|}~]{1,62}){0,63}`,
+  EMAILADDRESS: String.raw`%{EMAILLOCALPART}@%{HOSTNAME}`,
+
+  /* --- Paths and URIs --- */
+  UNIXPATH: String.raw`(?:/[\w_%!$@:.,+~-]*)+`,
+  WINPATH: String.raw`(?:[A-Za-z]+:|\\)(?:\\[^\\?*]*)+`,
+  PATH: String.raw`(?:%{UNIXPATH}|%{WINPATH})`,
+  URIPROTO: String.raw`[A-Za-z][A-Za-z0-9+.-]+`,
+  URIHOST: String.raw`%{IPORHOST}(?::%{POSINT})?`,
+  URIPATH: String.raw`(?:/[A-Za-z0-9$.+!*'(){},~:;=@#%&_-]*)+`,
+  URIPARAM: String.raw`\?[A-Za-z0-9$.+!*'|(){},~@#%&/=:;_?<>\[\]-]*`,
+  URIPATHPARAM: String.raw`%{URIPATH}(?:%{URIPARAM})?`,
+  URI: String.raw`%{URIPROTO}://(?:%{USER}(?::[^@]*)?@)?(?:%{URIHOST})?(?:%{URIPATHPARAM})?`,
+
+  /* --- Dates and times --- */
+  MONTH: String.raw`\b(?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)?|May|Jun(?:e)?|Jul(?:y)?|Aug(?:ust)?|Sep(?:tember)?|Oct(?:ober)?|Nov(?:ember)?|Dec(?:ember)?)\b`,
+  MONTHNUM: String.raw`(?:0?[1-9]|1[0-2])`,
+  MONTHNUM2: String.raw`(?:0[1-9]|1[0-2])`,
+  MONTHDAY: String.raw`(?:0[1-9]|[12][0-9]|3[01]|[1-9])`,
+  DAY: String.raw`(?:Mon(?:day)?|Tue(?:sday)?|Wed(?:nesday)?|Thu(?:rsday)?|Fri(?:day)?|Sat(?:urday)?|Sun(?:day)?)`,
+  YEAR: String.raw`(?:\d\d){1,2}`,
+  HOUR: String.raw`(?:2[0123]|[01]?[0-9])`,
+  MINUTE: String.raw`(?:[0-5][0-9])`,
+  SECOND: String.raw`(?:(?:[0-5]?[0-9]|60)(?:[:.,][0-9]+)?)`,
+  TIME: String.raw`(?:%{HOUR}:%{MINUTE}(?::%{SECOND})?)`,
+  DATE_US: String.raw`%{MONTHNUM}[/-]%{MONTHDAY}[/-]%{YEAR}`,
+  DATE_EU: String.raw`%{MONTHDAY}[./-]%{MONTHNUM}[./-]%{YEAR}`,
+  DATE: String.raw`(?:%{DATE_US}|%{DATE_EU})`,
+  ISO8601_TIMEZONE: String.raw`(?:Z|[+-]%{HOUR}(?::?%{MINUTE})?)`,
+  TIMESTAMP_ISO8601: String.raw`%{YEAR}-%{MONTHNUM2}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?(?:%{ISO8601_TIMEZONE})?`,
+  DATESTAMP: String.raw`%{DATE}[- ]%{TIME}`,
+  TZ: String.raw`(?:[APMCE][SD]T|UTC|GMT)`,
+  HTTPDATE: String.raw`%{MONTHDAY}/%{MONTH}/%{YEAR}:%{TIME} %{INT}`,
+  SYSLOGTIMESTAMP: String.raw`%{MONTH} +%{MONTHDAY} %{TIME}`,
+
+  /* --- Log shapes --- */
+  LOGLEVEL: String.raw`(?:[Aa]lert|ALERT|[Tt]race|TRACE|[Dd]ebug|DEBUG|[Nn]otice|NOTICE|[Ii]nfo(?:rmation)?|INFO(?:RMATION)?|[Ww]arn(?:ing)?|WARN(?:ING)?|[Ee]rr(?:or)?|ERR(?:OR)?|[Cc]rit(?:ical)?|CRIT(?:ICAL)?|[Ff]atal|FATAL|[Ss]evere|SEVERE|[Ee]merg(?:ency)?|EMERG(?:ENCY)?)`,
+  PROG: String.raw`[\x21-\x5a\x5c\x5e-\x7e]+`,
+  SYSLOGPROG: String.raw`%{PROG:program}(?:\[%{POSINT:pid}\])?`,
+  SYSLOGFACILITY: String.raw`<%{NONNEGINT:facility}\.%{NONNEGINT:priority}>`,
+  SYSLOGBASE: String.raw`%{SYSLOGTIMESTAMP:timestamp} (?:%{SYSLOGFACILITY} )?%{IPORHOST:logsource} %{SYSLOGPROG}:`,
+  JAVACLASS: String.raw`(?:[a-zA-Z$_][a-zA-Z$_0-9]*\.)*[a-zA-Z$_][a-zA-Z$_0-9]*`,
+  COMMONAPACHELOG: String.raw`%{IPORHOST:clientip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:timestamp}\] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-)`,
+  COMBINEDAPACHELOG: String.raw`%{COMMONAPACHELOG} %{QS:referrer} %{QS:agent}`,
+};
+
+/*
+ * Names only, sorted — the pattern picker in the processor form lists
+ * these so a user can see what is available without leaving the page.
+ */
+export function getGrokPatternNames(): Array<string> {
+  return Object.keys(GrokPatterns).sort();
+}
+
+export default GrokPatterns;

package/Utils/Monitor/NetworkDeviceMonitorTemplateUtil.ts

@@ -1,7 +1,6 @@
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import MonitorTemplate from "../../Models/DatabaseModels/MonitorTemplate";
 import NetworkDevice from "../../Models/DatabaseModels/NetworkDevice";
-import ColumnLength from "../../Types/Database/ColumnLength";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import JSONFunctions from "../../Types/JSONFunctions";
@@ -25,6 +24,29 @@ import ObjectID from "../../Types/ObjectID";
  * rule-engine, and audit hooks still run.
  */
 
+/*
+ * The widest name a provisioned monitor may carry.
+ *
+ * Monitor.name is varchar(100), but the real ceiling is the SLUG: Monitor is
+ * @SlugifyColumn("name", "slug") and Slug.getSlug appends a dash plus ten
+ * random digits into its own varchar(100), and the create path THROWS on
+ * overflow rather than truncating. A name that fills the name column
+ * therefore produces a 111-character slug and fails the insert — the monitor
+ * is counted into `monitorsFailed` and the device silently never gets one.
+ *
+ * 88 leaves exactly the slug's 11-character tail, the same cap
+ * MAX_PING_MONITOR_NAME_LENGTH uses on the other provisioning path. Device
+ * names arrive clamped to 80 by DiscoveredDeviceBuilder, so this only bites a
+ * device renamed by hand or a long template suffix.
+ */
+export const MAX_PROVISIONED_MONITOR_NAME_LENGTH: number = 88;
+
+/*
+ * What sits between the device's own identity and the template's default
+ * monitor name when the template supplies one.
+ */
+const MONITOR_NAME_SEPARATOR: string = " - ";
+
 type NetworkDeviceId = ObjectID | string | null | undefined;
 
 export interface RebindNetworkDeviceMonitorStepsData {
@@ -300,12 +322,42 @@ export default class NetworkDeviceMonitorTemplateUtil {
       data.networkDevice.hostname?.trim() ||
       `Network Device ${networkDeviceId}`;
     const templateMonitorName: string =
-      data.monitorTemplate.monitorName?.trim() || "Monitor";
-
-    return this.truncateWithoutSplittingSurrogatePair(
-      `${deviceIdentity} - ${templateMonitorName}`,
-      ColumnLength.ShortText,
+      data.monitorTemplate.monitorName?.trim() || "";
+
+    /*
+     * The suffix is OPT-IN (issue #3486). A template with no default monitor
+     * name names its monitors after the device and nothing else, because the
+     * alternative — the old `|| "Monitor"` fallback — was an invented suffix
+     * on an estate the operator never asked to have suffixed. A template that
+     * DOES carry a name keeps the composed form, which is what tells two
+     * templates apart on the same device.
+     */
+    const composedName: string = templateMonitorName
+      ? `${deviceIdentity}${MONITOR_NAME_SEPARATOR}${templateMonitorName}`
+      : deviceIdentity;
+
+    const truncatedName: string = this.truncateWithoutSplittingSurrogatePair(
+      composedName,
+      MAX_PROVISIONED_MONITOR_NAME_LENGTH,
     );
+
+    /*
+     * The device identity leads, so a cap reached inside the separator leaves
+     * the name trailing " ", " -" or " - " — a suffix that is visibly half
+     * there. Everything that survived such a cut IS the device identity, so
+     * return that rather than the remnant. Checked by LENGTH rather than by
+     * trailing characters, so a device genuinely named "Router A -" keeps its
+     * own trailing hyphen when nothing was cut at all.
+     */
+    if (
+      truncatedName.length > deviceIdentity.length &&
+      truncatedName.length <=
+        deviceIdentity.length + MONITOR_NAME_SEPARATOR.length
+    ) {
+      return deviceIdentity;
+    }
+
+    return truncatedName;
   }
 
   private static truncateWithoutSplittingSurrogatePair(