[Citrix Web App Firewall V 1.16.1]: Error Grok expressions

### Integration Name

Citrix Web App Firewall [citrix_waf]

### Dataset Name

_No response_

### Integration Version

1.16.1

### Agent Version

8.17.0

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.0

### OS Version and Architecture

Ubuntu 18.04.3 LTS

### Software/API Version

_No response_

### Error Message

error.message
Provided Grok expressions do not match field value: [<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http://192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked]

### Event Original

citrix.detail
<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http://192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked

### What did you do?

I did integration of citrix adc NS14.1 build 29.63 with Citrix Web App Firewall V 1.16.1

### What did you see?

but in the log in elastic, error.message appears
Provided Grok expressions do not match field value: [<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http:/ /192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked]

### What did you expect to see?

With the log that has been sent there should be no errors if it is in accordance with the CEF format.
<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http://192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked

### Anything else?

Here is the complete log
{
"_index": ".ds-logs-citrix_waf.log-default-2024.12.27-000001",
"_id": "ioYnG5QBKEN-KaXZGRfn",
"_version": 1,
"_source": {
"input": {
"type": "udp"
},
"agent": {
"name": "minio",
"id": "cfc94908-1033-40dc-9d6c-d86e2ed3e734",
"ephemeral_id": "4ad60ce6-5cdc-4607-8bd7-239213beeea8",
"type": "filebeat",
"version": "8.17.0"
},
"@timestamp": "2024-12-31T05:18:45.597Z",
"ecs": {
"version": "8.11.0"
},
"log": {
"source": {
"address": "192.168.5.45:32793"
}
},
"data_stream": {
"namespace": "default",
"type": "logs",
"dataset": "citrix_waf.log"
},
"elastic_agent": {
"id": "cfc94908-1033-40dc-9d6c-d86e2ed3e734",
"version": "8.17.0",
"snapshot": false
},
"event": {
"agent_id_status": "verified",
"ingested": "2024-12-31T05:18:54Z",
"timezone": "+07:00",
"kind": "pipeline_error",
"dataset": "citrix_waf.log"
},
"error": {
"message": [
"Provided Grok expressions do not match field value: [<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http://192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked]"
]
},
"citrix": {
"detail": "<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http://192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked",
"cef_format": false
},
"tags": [
"citrix_waf",
"forwarded"
]
},
"fields": {
"elastic_agent.version": [
"8.17.0"
],
"citrix.detail": [
"<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http://192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked"
],
"agent.type": [
"filebeat"
],
"event.module": [
"citrix_waf"
],
"agent.name.text": [
"minio"
],
"agent.name": [
"minio"
],
"elastic_agent.snapshot": [
false
],
"event.agent_id_status": [
"verified"
],
"event.kind": [
"pipeline_error"
],
"event.timezone": [
"+07:00"
],
"elastic_agent.id": [
"cfc94908-1033-40dc-9d6c-d86e2ed3e734"
],
"data_stream.namespace": [
"default"
],
"input.type": [
"udp"
],
"data_stream.type": [
"logs"
],
"tags": [
"citrix_waf",
"forwarded"
],
"event.ingested": [
"2024-12-31T05:18:54.000Z"
],
"@timestamp": [
"2024-12-31T05:18:45.597Z"
],
"citrix.cef_format": [
false
],
"agent.id": [
"cfc94908-1033-40dc-9d6c-d86e2ed3e734"
],
"ecs.version": [
"8.11.0"
],
"error.message": [
"Provided Grok expressions do not match field value: [<134> CEF:0|Citrix|NetScaler|NS14.1|APPFW|APPFW_POLICY_HIT|6|src=10.3.46.252 geolocation=Unknown spt=12562 method=GET request=http://192.168.5.208/favicon.ico msg=Application Firewall profile invoked cn1=1121531 cn2=535384 cs1=APPFW_BLOCK cs2=PPE0 cs4=ALERT cs5=2024 act=blocked]"
],
"log.source.address": [
"192.168.5.45:32793"
],
"data_stream.dataset": [
"citrix_waf.log"
],
"agent.ephemeral_id": [
"4ad60ce6-5cdc-4607-8bd7-239213beeea8"
],
"agent.version": [
"8.17.0"
],
"event.dataset": [
"citrix_waf.log"
]
}
}