[citrix_adc] Handle time zone parsing in sslvpn_and_aaatm_feature pipeline

[mjwolf]

Proposed commit message

This has a few pipeline improvements

• Fail if sslvpn_and_aaatm_feature message data cannot be parsed. If this data is not parsed, most data provided by this pipeline is silently not populated. So I think overall its better to fail, so that users and developers are more aware that there is an error.
• Improve parsing of the message to handle optional space between username and Group key. Both formats have been observed.
• Handle the presence of time zone in the message timestamp.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[pkoutsovasilis]

manifest needs to get updated as well? also this isn't a sec-deployment-and-devices integration?! or at least the .github/CODEOWNERS does not say so

[mjwolf]

manifest needs to get updated as well? also this isn't a sec-deployment-and-devices integration?! or at least the .github/CODEOWNERS does not say so

I've updated the manifest. And yeah, I guess we don't own this. It seems like an integration we'd own, and I didn't check before working on it

[pkoutsovasilis]

I've updated the manifest. And yeah, I guess we don't own this. It seems like an integration we'd own, and I didn't check before working on it

definitely no worries, I see no issue with that! just checking if my eyes were deceiving me. However this means even if I approve you know 🙂

[pkoutsovasilis]

LGTM

[elasticmachine]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 5877c49

History

• 💚 Build #14881 succeeded c1deaa6

cc @mjwolf

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[shmsr]

Changes look good, but I noticed a spelling error: "received" is misspelled as "recieved" in some places while reviewing. But it is unrelated to the change made here.

[elasticmachine]

Package citrix_adc - 1.7.2 containing this change is available at https://epr.elastic.co/search?package=citrix_adc

[muthu-mps]

@mjwolf - The citrix_waf integration also does processing the logs for citrix_adc. Do you consider validating the scenario with the WAF integration as well?