[Arista NG Firewall] Correct Grok pattern due to change in Syslog message format.

[MakoWish]

Type of change

• Bug

Proposed commit message

A recent update to Arista NG Firewall changed the Syslog message format slightly. Where there used to be two spaces after uvm[0]: , the new format only includes a single space. The following Grok pattern accounts for both the old double-spaced format and the new single-spaced format.

<%{NONNEGINT:log.syslog.priority:int}>%{SYSLOGTIMESTAMP:_temp_.raw_date} %{WORD}  %{NOTSPACE}\:[\s]+%{GREEDYDATA:_temp_.full_message}

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• Tested changes locally

How to test this PR locally

Modified the default ingest pipeline with the proposed Grok pattern change, and the messages are now parsing again properly.

Related issues

• Closes [Arista NG Firewall]: Grok Parsing Errors Due to Updated Syslog Message Format #12175

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)