[cisco_ftd] Fix grok failure with username with spaces on ftd messageID.

[aleksmaus]

Proposed commit message

Fix grok failure with username with spaces on ftd messageID.

• Added alternative pattern as suggested in original issue ticket
  [cisco_ftd]: Can't Grok Username with spaces on ftd messageID 113039 #10721
  It is currently just DATA pattern match, not sure if we should tighten this further.
• Improved on failure message.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Closes [cisco_ftd]: Can't Grok Username with spaces on ftd messageID 113039 #10721

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[taylor-swanson]

I'm really not sure why these patterns were made to be so complicated. As these issues have come up, I've started taking this approach over in cisco_asa: https://github.com/elastic/integrations/blob/main/packages/cisco_asa/data_stream/log/elasticsearch/ingest_pipeline/default.yml#L935

At the end of the day, the values we extract are either made of "not angle brackets" or "not spaces", depending on which pattern in the grok is used. We definitely need to get out of the business of trying to validate these logs.

I highly recommend the same approach here.

[aleksmaus]

@taylor-swanson I updated the grok patterns per your suggestion. Could you take another look and give it 👍 ?

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3590ca4

History

• 💚 Build #16673 succeeded c942823
• 💚 Build #16238 succeeded 0331dd1
• 💔 Build #16232 failed 6c9c40b

cc @aleksmaus

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
71.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package cisco_ftd - 3.4.2 containing this change is available at https://epr.elastic.co/search?package=cisco_ftd