[cisco_ios] fix observer.type precedence for IOS logs

[qcorporation]

Proposed commit message

Fix incorrect observer.type defaulting in Cisco IOS log pipeline by replacing broad firewall default behavior with precedence-based classification.

WHAT: Update ingest processor ordering and conditions so observer.type is set deterministically: preserve existing explicit values, assign firewall only for clear firewall/security signals, assign switch for L2/switch indicators (including known facility/message tokens), and use router as final fallback when no prior classification applies. Update existing pipeline expected outputs to reflect corrected values without adding fabricated log formats.

WHY: Cisco IOS events were being over-classified as firewall, reducing ECS accuracy and affecting analytics that depend on observer.type. This change keeps valid firewall classification while correcting default behavior for router/switch IOS logs.

NOTE:
LINEPROTO — test data coming from an ASR920 (which is a router-switch hybrid PE device):
Whether that's right depends on context. On pure routers, %LINEPROTO-5-UPDOWN is extremely common (WAN links, tunnel interfaces). Assigning switch to those would be wrong. However, removing LINEPROTO from the switch list would mean real switch events (e.g. access port flapping) fall through to router, which is less accurate.

Checklist

[x] I have reviewed tips for building integrations and this pull request is aligned with them.
[x] I have verified that all data streams collect metrics or logs.
[x] I have added an entry to my package's changelog.yml file.
[ ] I have verified that Kibana version constraints are current according to guidelines.
[ ] I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ] observer.type: firewall remains only where evidence-based conditions apply.
[ ] observer.type precedence is deterministic and documented in pipeline comments/PR notes.

How to test this PR locally

cd packages/cisco_ios
elastic-package test pipeline --data-streams log

Verify that:

firewall is only asserted for events with explicit firewall/security signals,
switch indicators map to observer.type: switch,
remaining IOS logs fall back to observer.type: router.

Related issues

Closes #14608

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

Pinging @elastic/integration-experience (Team:Integration-Experience)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 3c0b892

History

• 💚 Build #41538 succeeded c486e5f
• 💚 Build #41451 succeeded 6a37300

cc @qcorporation

[elastic-vault-github-plugin-prod]

Package cisco_ios - 1.35.3 containing this change is available at https://epr.elastic.co/package/cisco_ios/1.35.3/