Cisco module ingest processor for ASA 106023 events doesn't account for all possibilities

[makeitthingsbetter]

• Version: 7.7.0
• Steps to Reproduce:

The ASA 106023 log event can produce log lines similar to both of the following:

%ASA-4-106023: Deny tcp src outside:1.2.3.4/35539 dst inside:2.3.4.5/8530 by access-group "outside_incoming_list" [0x0, 0x0]
or
%ASA-4-106023: Deny udp src outside:11.2.3.4/4104(LOCAL\username) dst inside:2.3.4.5/4104 by access-group "outside_incoming_list" [0x0, 0x0]

Currently the second log (with the username) event cannot be indexed because the dissect pattern crashes.

Dissect Pattern in beats/x-pack/filebeat/module/cisco/shared/ingest/asa-ftd-pipeline.yml:

 - dissect:
      if: "ctx._temp_.cisco.message_id == '106023'"
      field: "message"
      pattern: '%{event.outcome} %{network.transport} src %{_temp_.cisco.source_interface}:%{source.address}/%{source.port} dst %{_temp_.cisco.destination_interface}:%{destination.address}/%{destination.port} %{} access%{}group "%{_temp_.cisco.list_id}"%{}'

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[makeitthingsbetter]

Update:
Issue also in 7.8.0 present

[adriansr]

This was fixed by #17964

The fix will appear in 7.8.1.