[cisco_ise] Fixed queue link error prefix parsing

[kgeller]

Proposed commit message

Fix parsing of "Queue Link Error" alarm messages that include a prefix before the From keyword.

More context

Problem

The existing dissect pattern From %{source.address} To %{destination.address} failed to parse alarm messages with the format: Certificate Issue From <host> To <host> , while it worked for the simpler format:From <host> To <host>

Solution

Replaced the dissect processor with a grok processor using the pattern:
^(%{DATA} )?From %{DATA:source.address} To %{DATA:destination.address}$
The optional (%{DATA} )? group allows matching both message formats - with or without a prefix before "From".

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: d377c1f

cc @kgeller

[elastic-vault-github-plugin-prod]

Package cisco_ise - 1.30.2 containing this change is available at https://epr.elastic.co/package/cisco_ise/1.30.2/