[PPS]: Fix parsing for plain usernames and space-padded dates for syslog messages

[ShourieG]

Type of change

• Bug

Proposed commit message

pps: fix parsing for plain usernames and space-padded dates

Adds a grok pattern variant to handle syslog messages where the username
has no domain suffix (e.g. `jsmith - Admins - Success` vs `user@domain - Success`).

This also fixes the `Backup Restore Service` entries which were previously
matched by the fallback pattern and incorrectly mapped the hostname to
`host.domain` instead of `host.hostname`.

Also adds `MMM  d HH:mm:ss` as an additional date format to handle BSD syslog's
space-padded single-digit days (e.g. `Feb  5`), which caused the date processor
to throw a parse error at index 4.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[efd6]

Suggested change

	- "MMM dd HH:mm:ss"
	- "MMM d HH:mm:ss"
	- "MMM [dd][ d] HH:mm:ss"

[efd6]

Suggested change

	- "MMM dd HH:mm:ss"
	- "MMM d HH:mm:ss"
	- "MMM [dd][ d] HH:mm:ss"

[ShourieG]

@efd6, resolved all comments

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 977a5c1

History

• 💚 Build #39426 succeeded d4da74e

cc @ShourieG

[elastic-vault-github-plugin-prod]

Package pps - 1.2.1 containing this change is available at https://epr.elastic.co/package/pps/1.2.1/

[ghost]

Hi @ShourieG , thank you for the fix. However, I have noticed that the new pattern in the date processor struggles when numbers for the day and for the hour are the same. E.g. "Mar 10 10:00:00" leads to an error, while "Mar 11 10:00:00" is working just fine. Would it be possible for you to address this issue? Thanks in advance!