Filebeat sophos/utm: Support logs containing hostname in syslog header

[adriansr]

What does this PR do?

Updates the sophos/utm fileset (rsa2elk) so that it prioritizes logs that contain a hostname in their syslog header.

Why is it important?

Without this change, logs with a hostname are not correctly parsed.

Checklist

• [ ] My code follows the style guidelines of this project
• [ ] I have commented my code, particularly in hard-to-understand areas
• [ ] I have made corresponding changes to the documentation
• [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Known issues

Note that this change in turn can cause problems with syslog headers that don't contain a hostname. Due to the way the logs are structured, it's not possible to reliably support both scenarios at the same time.

This prioritizes logs with a hostname, hoping that they are more common.

As an example, given the following log (without a hostname):

2016:01:29-06:09:59 smtpd[905]: MASTER[NNN]: QR globally disabled, status one set to 'disabled'

The current parser will take smtpd[905] as hostname, MASTER as the message ID and NNN as the process ID.

Because of this, is recommended that all logs include a hostname.

Related issues

• Closes Sophos UTM Integration incorrectly parses message header integrations#1540

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b fix_sophos_utm_header_order upstream/fix_sophos_utm_header_order
git merge upstream/master
git push upstream fix_sophos_utm_header_order

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Duration: 93 min 23 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

[adriansr]

@Mergifyio refresh

[mergify]

refresh

✅ Pull request refreshed