[Filebeat] Update Grok pattern for UDM logs

[legoguy1000]

What does this PR do?

Updates the IPtables ingest pipeline with an additional grok pattern.

Why is it important?

The module currently isn't able to parse some log entries created by the UDM pro

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes Iptables module unable to parse some logs from UDM-Pro device #25615

Use cases

Screenshots

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #25616 updated

• Start Time: 2021-05-13T11:30:56.320+0000

• Duration: 108 min 33 sec

• Commit: bd5a220

Test stats 🧪

Test	Results
Failed	0
Passed	7031
Skipped	1193
Total	8224

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	7031
Skipped	1193
Total	8224

[legoguy1000]

@JAndritsch Let me know what you think for these changes. Also if you find out anything on the weird format of these logs, let me know.

[JAndritsch]

@JAndritsch Let me know what you think for these changes. Also if you find out anything on the weird format of these logs, let me know.

I'll try to test them out today. I just posted an issue on the Ubiquiti forums, so hopefully that'll help shed some light on things.

https://community.ui.com/questions/Strange-UDM-Pro-log-formatting/27969dc6-78eb-4d17-9417-38d252c62ce9

[JAndritsch]

I just had a chance to test these changes. It looks like the sample messages I gave you now parse properly. I was hoping to hear back from the UI forums before this gets merged, but it's quiet over there. I still feel like there's got to be something wrong with the log format from those UDM logs.

[P1llus]

If it is working as you would expected we can go ahead and merge it, worst case scenario we can apply more changes later on if needed.

[P1llus]

run tests

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[P1llus]

LGTM, waiting for CI to pass

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 25615-udm-logs upstream/25615-udm-logs
git merge upstream/master
git push upstream 25615-udm-logs

[P1llus]

run tests

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 25615-udm-logs upstream/25615-udm-logs
git merge upstream/master
git push upstream 25615-udm-logs