[cisco_ios] Remove erroneous period from repeated messages grok

[taylor-swanson]

Proposed commit message

• During initial development, a period at the end of the repeated messages grok was added by mistake
• The period has been removed and tests updated

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

How to test this PR locally

cd packages/cisco_ios
elastic-package test

Related issues

• Relates Cisco IOS Grok Failure #8989

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 8d53fec

cc @taylor-swanson

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[IanLee1521]

LGTM!

[taylor-swanson]

@IanLee1521, just as a heads up, I ran the log you provided though as a test, and while it no longer produces a grok error, the header portion of the message doesn't get parsed out correctly. It doesn't produce an error, but some of the fields get assigned incorrectly.

<46>: 2024 Feb 21 23:53:26 PST: last message repeated 121 times

{
    "cisco": {
        "ios": {
            "uptime": "<46>"
        }
    },
    "ecs": {
        "version": "8.11.0"
    },
    "event": {
        "category": [
            "network"
        ],
        "original": "<46>: 2024 Feb 21 23:53:26 PST: last message repeated 121 times",
        "provider": "firewall",
        "timezone": "UTC",
        "type": [
            "info"
        ]
    },
    "message": "last message repeated 121 times",
    "observer": {
        "product": "IOS",
        "type": "firewall",
        "vendor": "Cisco"
    },
    "tags": [
        "preserve_original_event"
    ]
}

It seems like the timestamp is the culprit. In all of the other logs, it goes Month Day Year while the log in question goes Year Month Day. I see if I can handle this case in the #9102 PR.

[elasticmachine]

Package cisco_ios - 1.25.1 containing this change is available at https://epr.elastic.co/search?package=cisco_ios