[Cisco ISE]: CISE_Administrative_and_Operational_Audit - field [cisco_ise.log.log_details_raw] does not contain value_split if cisco_ise.log.log_details_raw contains an escaped comma

### Integration Name

Cisco ISE [cisco_ise]

### Dataset Name

cisco_ise.log

### Integration Version

1.25.0

### Agent Version

8.17.2

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.17.2

### OS Version and Architecture

Ubuntu 22.04.5 LTS

### Software/API Version

Cisco ISE 3.2.0.542

### Error Message

`field [cisco_ise.log.log_details_raw] does not contain value_split [=]`

### Event Original

```
"<181>Mar 6 12:55:26 xxxxxx CISE_Administrative_and_Operational_Audit 0003339569 1 0 2025-03-06 12:55:26.479 +01:00 0081440953 61026 NOTICE EAP-TLS: Shutdown secure connection with TLS peer, ConfigVersionId=74, PeerAddress=xx-xx-xx-xx-xx-xx, PeerName=CN=Surname\\, Firstname, UniqueConnectionIdentifier =xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, ShutdownReason =ClosedByISE, "
```

### What did you do?

Parse error when `cisco_ise.log.log_details_raw` contains an escaped comma

### What did you see?

```
{
"_index": ".ds-logs-cisco_ise.log-prod-2025.02.26-xxxxxx",
"_id": "xxxxxxxxxxxxxxxxxxxx",
"_version": 1,
"_size": xxxx,
"_source": {
"agent": {
"name": "xxxxxx",
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"type": "filebeat",
"ephemeral_id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"version": "8.17.2"
},
"cisco_ise": {
"log": {
"log_details": {
"PeerAddress": "xx-xx-xx-xx-xx-xx",
"PeerName": "CN=Surname\\"
},
"segment": {
"number": 0,
"total": 1
},
"category": {
"name": "CISE_Administrative_and_Operational_Audit"
},
"message": {
"code": "61026",
"description": "EAP-TLS: Shutdown secure connection with TLS peer",
"id": "0003339569"
},
"config_version": {
"id": 74
}
}
},
"log": {
"level": "notice",
"source": {
"address": "xx.xx.xx.xx:xxxxx"
},
"syslog": {
"severity": {
"name": "notice"
},
"priority": 181
}
},
"elastic_agent": {
"id": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
"version": "8.17.2",
"snapshot": false
},
"message": "2025-03-06 12:55:26.479 +01:00 0081440953 61026 NOTICE EAP-TLS: Shutdown secure connection with TLS peer, ConfigVersionId=74, PeerAddress=xx-xx-xx-xx-xx-xx, PeerName=CN=Surname\\, Firstname, UniqueConnectionIdentifier =xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, ShutdownReason =ClosedByISE,",
"error": {
"message": [
"field [cisco_ise.log.log_details_raw] does not contain value_split [=]"
]
},
"tags": [
"preserve_original_event",
"forwarded",
"cisco_ise-log"
],
"input": {
"type": "udp"
},
"@timestamp": "2025-03-06T12:55:26.000Z",
"ecs": {
"version": "8.17.0"
},
"related": {
"hosts": [
"xxxxxx"
]
},
"data_stream": {
"namespace": "prod",
"type": "logs",
"dataset": "cisco_ise.log"
},
"host": {
"hostname": "xxxxxx"
},
"event": {
"agent_id_status": "verified",
"sequence": 81440953,
"ingested": "2025-03-06T11:55:27Z",
"original": "<181>Mar 6 12:55:26 xxxxxx CISE_Administrative_and_Operational_Audit 0003339569 1 0 2025-03-06 12:55:26.479 +01:00 0081440953 61026 NOTICE EAP-TLS: Shutdown secure connection with TLS peer, ConfigVersionId=74, PeerAddress=xx-xx-xx-xx-xx-xx, PeerName=CN=Surname\\, Firstname, UniqueConnectionIdentifier =xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, ShutdownReason =ClosedByISE, ",
"code": "61026",
"kind": "pipeline_error",
"timezone": "+01:00",
"dataset": "cisco_ise.log"
}
},
"fields": {
"elastic_agent.version": [
"8.17.2"
],
"cisco_ise.log.category.name": [
"CISE_Administrative_and_Operational_Audit"
],
"host.hostname": [
"xxxxxx"
],
"cisco_ise.log.config_version.id": [
74
],
"event.sequence": [
81440953
],
"agent.type": [
"filebeat"
],
"event.module": [
"cisco_ise"
],
"agent.name.text": [
"xxxxxx"
],
"cisco_ise.log.message.description": [
"EAP-TLS: Shutdown secure connection with TLS peer"
],
"log.level": [
"notice"
],
"log.syslog.severity.name": [
"notice"
],
"_meta.size": [
xxxx
],
"agent.name": [
"xxxxxx"
],
"elastic_agent.snapshot": [
false
],
"cisco_ise.log.segment.total": [
1
],
"event.agent_id_status": [
"verified"
],
"log.syslog.priority": [
181
],
"cisco_ise.log.log_details": [
{
"PeerAddress": "xx-xx-xx-xx-xx-xx",
"PeerName": "CN=Surname\\"
}
],
"event.kind": [
"pipeline_error"
],
"event.timezone": [
"+01:00"
],
"event.original": [
"<181>Mar 6 12:55:26 xxxxx CISE_Administrative_and_Operational_Audit 0003339569 1 0 2025-03-06 12:55:26.479 +01:00 0081440953 61026 NOTICE EAP-TLS: Shutdown secure connection with TLS peer, ConfigVersionId=74, PeerAddress=xx-xx-xx-xx-xx-xx, PeerName=CN=Surname\\, Firstname, UniqueConnectionIdentifier =xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, ShutdownReason =ClosedByISE, "
],
"elastic_agent.id": [
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
],
"data_stream.namespace": [
"prod"
],
"input.type": [
"udp"
],
"message": [
"2025-03-06 12:55:26.479 +01:00 0081440953 61026 NOTICE EAP-TLS: Shutdown secure connection with TLS peer, ConfigVersionId=74, PeerAddress=xx-xx-xx-xx-xx-xx, PeerName=CN=Surname\\, Firstname, UniqueConnectionIdentifier =xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, ShutdownReason =ClosedByISE,"
],
"data_stream.type": [
"logs"
],
"tags": [
"preserve_original_event",
"forwarded",
"cisco_ise-log"
],
"event.ingested": [
"2025-03-06T11:55:27.000Z"
],
"@timestamp": [
"2025-03-06T12:55:26.000Z"
],
"event.code": [
"61026"
],
"agent.id": [
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
],
"ecs.version": [
"8.17.0"
],
"error.message": [
"field [cisco_ise.log.log_details_raw] does not contain value_split [=]"
],
"log.source.address": [
"xx.xx.xx.xx:xxxxx"
],
"data_stream.dataset": [
"cisco_ise.log"
],
"agent.ephemeral_id": [
"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
],
"agent.version": [
"8.17.2"
],
"cisco_ise.log.segment.number": [
0
],
"related.hosts": [
"xxxxxx"
],
"cisco_ise.log.message.code": [
"61026"
],
"cisco_ise.log.message.id": [
"0003339569"
],
"event.dataset": [
"cisco_ise.log"
]
}
}
```

### What did you expect to see?

Expected the escaped comma to not be treated as the field split delimiter, which is set to `,` in the `logs-cisco_ise.log-1.25.0-pipeline_administrative_and_operational_audit` pipeline.

### Anything else?

_No response_