[cisco_ios] Fix CISCO-IOS integration failed to parse logs coming from different application versions

[aleksmaus]

Proposed commit message

Fix CISCO-IOS integration failed to parse logs coming from different application versions.

This fixes yet another SDH coming from the user that provided yet another sample of logs that have a different format.

@pkoutsovasilis I noticed the difference in the expected output files between 8.15 and 8.16 version of the stack when running the pipeline tests. Few files for the community_id added when running pipeline test against 8.16:

            "network": {
                "community_id": "1:NCx7UOZoQUvxIB+uzqMmGnZTSzI=",

Assuming this might be expected due to this change elastic/elasticsearch#111528. But wanted to get your 👀 on this in case if this is not expected from Elasticsearch side.

This PR includes the files regenerated with 8.15 at the moment. Will see if CI complains, then can regenerate against 8.16.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 278eabd

cc @aleksmaus

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[aleksmaus]

Interesting, CI passed, so the community_id change/addition is not in the stack yet that is being used for CI tests here. I assume the integration tests will break once the elasticsearch change makes to CI.

[pkoutsovasilis]

hi @aleksmaus 👋 the differences that you mention for the community_id are indeed expected in 8.16.0 of Elasticsearch. The issue that captures the reason behind this change is the this one and essentially at this version of Elasticsearch we should get community ids for all supported protocol numbers

[pkoutsovasilis]

LGTM

[elasticmachine]

Package cisco_ios - 1.26.11 containing this change is available at https://epr.elastic.co/search?package=cisco_ios