[Cisco ISE] Handle logs that start with ISO8601 timestamp

[aleksmaus]

Proposed commit message

Handle logs that start with ISO8601 timestamp.
Addresses: https://github.com/elastic/sdh-beats/issues/4916

Example of the message

"original": "2024-07-03T08:14:41.015673-05:00 stpnisep01 CISE_System_Statistics 0000563881 1 0 2024-07-03 13:14:41.016 +00:00 0007457477 70011 NOTICE System-Stats: ISE Counters, ConfigVersionId=169, OperationCounters=Counter=1_Number_of_Guests:112,4_SNMPTRAP_Endpoint_Detected:0,4_HostName_Event_Fetch_FromAD:0,4_DNS_Endpoint_Detected:0,13_Protocol_Runtime_Context:-9,4_SNMPTrap_Events_Received:0,4_DNSReverseLookup_Events_Query:2766,4_Http_Endpoint_Detected:0,4_Probe_Requests_Dropped:0,4_Probe_Requests_Received:0,4_Radius_Endpoint_Detected:6855,4_ArpCache_InsertUpdate_Received:947,4_SNMP_Endpoint_Detected:0,16_iowait:11,4_SNMPQuery_Events_Query:2225,4_DHCP_Endpoint_Detected:0,4_EndpointCache_InsertUpdate_Received:60,4_DHCP_Skip_Profiling:0,4_EndPoint_Reprofiling_Events:753,4_Netflow_Endpoint_Detected:0,4_RadiusPacketsReceived:8,4_NMAP_ScanEvent_Query:66, ",

that is failing with error

"message": "0 2024-07-03 13:14:41.016 +00:00 0007457477 70011 NOTICE System-Stats: ISE Counters, ConfigVersionId=169, OperationCounters=Counter=1_Number_of_Guests:112,4_SNMPTRAP_Endpoint_Detected:0,4_HostName_Event_Fetch_FromAD:0,4_DNS_Endpoint_Detected:0,13_Protocol_Runtime_Context:-9,4_SNMPTrap_Events_Received:0,4_DNSReverseLookup_Events_Query:2766,4_Http_Endpoint_Detected:0,4_Probe_Requests_Dropped:0,4_Probe_Requests_Received:0,4_Radius_Endpoint_Detected:6855,4_ArpCache_InsertUpdate_Received:947,4_SNMP_Endpoint_Detected:0,16_iowait:11,4_SNMPQuery_Events_Query:2225,4_DHCP_Endpoint_Detected:0,4_EndpointCache_InsertUpdate_Received:60,4_DHCP_Skip_Profiling:0,4_EndPoint_Reprofiling_Events:753,4_Netflow_Endpoint_Detected:0,4_RadiusPacketsReceived:8,4_NMAP_ScanEvent_Query:66,",
"error": {
"message": [
"field [_tmp] not present as part of path [_tmp.timestamp]"
]
},

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
58.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 9c20e4c

[pkoutsovasilis]

LGTM

[elasticmachine]

Package cisco_ise - 1.22.2 containing this change is available at https://epr.elastic.co/search?package=cisco_ise