x-pack/filebeat/module/cisco Fix Cisco module Grok pattern

[bhapas]

Proposed commit message

Fix Grok pattern in Cisco shared ingest pipeline.

1. Users have observed the following warning messages in Elasticsearch:

[2023-08-14T11:09:30,093][WARN ][o.e.i.c.GrokProcessor    ] [ES-NODE] character class has '-' without escape

2. The above warning message reports a problem with a pattern defined in a grok processor where a hyphen character is used as a literal character in a character class [ .... ] but the hyphen character is not escaped.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

1. Download Filebeat, configure it to connect to an Elasticsearch cluster and run filebeat setup -e. Wait for all the Filebeat assets (dashboards, ingest pipelines, etc.) to be loaded.

2. Check the Elasticsearch logs and observe the above warning message.

3. Delete all the ingest pipelines related to Filebeat (can be done in batch through Kibana > Stack Management > Ingest Pipelines)

4. Modify the file filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml to replace the 5 occurrences:

FROM:

HOSTNAME: "\\b(?:[0-9A-Za-z][0-9A-Za-z-_]{0,62})(?:\\.(?:[0-9A-Za-z][0-9A-Za-z-_]{0,62}))*(\\.?|\\b)"

TO:

HOSTNAME: "\\b(?:[0-9A-Za-z][0-9A-Za-z\\-_]{0,62})(?:\\.(?:[0-9A-Za-z][0-9A-Za-z\\-_]{0,62}))*(\\.?|\\b)"

5. run filebeat setup -e. Wait for all the Filebeat artefacts (dashboards, ingest pipelines, etc.) to be loaded.

6. Check the Elasticsearch: above warning message is no longer observed.

Related issues

• Closes Ingest pipelines from cisco modules are causing warning messages in Elasticsearch #36325

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-08-16T03:45:26.969+0000

• Duration: 76 min 23 sec

Test stats 🧪

Test	Results
Failed	0
Passed	3132
Skipped	176
Total	3308

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)