[cisco_ios] Add support for Kiwi format logs (#14294)

- Add support for Kiwi format logs. The Kiwi header is removed and the remaining log is parsed like a normal Cisco IOS log.

Author: taylor-swanson

packages/cisco_ios/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.31.0"
+ changes:
+ - description: Add support for Kiwi format logs
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/14294
 - version: "1.30.3"
  changes:
  - description: Add support for longer timezone formats

packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-kiwi.log

@@ -0,0 +1 @@
+<190>Original Address=192.168.0.1 1 2025-06-23T16:13:32.168Z syslog-host-1 Kiwi_SyslogNet_Server 3356 MSGOUT TEST-HOST-1: *Jun 23 15:52:38.534: %SYS-6-LOGOUT: User test-user has exited tty session 1(192.168.0.1)

packages/cisco_ios/data_stream/log/_dev/test/pipeline/test-kiwi.log-expected.json

@@ -0,0 +1,67 @@
+{
+ "expected": [
+ {
+ "@timestamp": "2025-06-23T15:52:38.534Z",
+ "cisco": {
+ "ios": {
+ "action": "exited",
+ "facility": "SYS",
+ "session": {
+ "number": "1",
+ "type": "tty"
+ }
+ }
+ },
+ "ecs": {
+ "version": "8.17.0"
+ },
+ "event": {
+ "category": [
+ "network"
+ ],
+ "code": "LOGOUT",
+ "original": "<190>Original Address=192.168.0.1 1 2025-06-23T16:13:32.168Z syslog-host-1 Kiwi_SyslogNet_Server 3356 MSGOUT TEST-HOST-1: *Jun 23 15:52:38.534: %SYS-6-LOGOUT: User test-user has exited tty session 1(192.168.0.1)",
+ "provider": "firewall",
+ "severity": 6,
+ "timezone": "UTC",
+ "type": [
+ "info"
+ ]
+ },
+ "log": {
+ "level": "informational",
+ "syslog": {
+ "hostname": "TEST-HOST-1",
+ "priority": 190
+ }
+ },
+ "message": "User test-user has exited tty session 1(192.168.0.1)",
+ "network": {
+ "type": "ipv4"
+ },
+ "observer": {
+ "product": "IOS",
+ "type": "firewall",
+ "vendor": "Cisco"
+ },
+ "related": {
+ "ip": [
+ "192.168.0.1"
+ ],
+ "user": [
+ "test-user"
+ ]
+ },
+ "source": {
+ "address": "192.168.0.1",
+ "ip": "192.168.0.1",
+ "user": {
+ "name": "test-user"
+ }
+ },
+ "tags": [
+ "preserve_original_event"
+ ]
+ }
+ ]
+}

packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml

@@ -33,6 +33,18 @@ processors:
  ignore_missing: true
  - grok:
  field: event.original
+ tag: grok_kiwi_header
+ description: |- 
+ The Kiwi syslog header is expected to be in the following format:
+ <PRI>Original Address=IP [RFC 5424 header] [Cisco IOS log]
+ 
+ This grok pattern currently only extracts the Cisco IOS log from
+ the event. It does not extract any Kiwi syslog header fields.
+ patterns:
+ - '^<%{NONNEGINT:log.syslog.priority:long}>Original Address=(?:%{DATA} ){7}%{GREEDYDATA:_temp_.message}$'
+ - '^%{GREEDYDATA:_temp_.message}$'
+ - grok:
+ field: _temp_.message
  tag: grok_header
  patterns:
  - '^%{CISCO_PRIORITY_MSGCOUNT}?%{TIMESTAMP_ISO8601:_temp_.cisco_timestamp} %{CISCO_HOSTNAME:log.syslog.hostname} %{GREEDYDATA:_temp_.message}$'

packages/cisco_ios/manifest.yml

@@ -1,7 +1,7 @@
 format_version: "3.0.3"
 name: cisco_ios
 title: Cisco IOS
-version: "1.30.3"
+version: "1.31.0"
 description: Collect logs from Cisco IOS with Elastic Agent.
 type: integration
 categories: