[panw] grok parse error for syslog message

### Integration Name

Palo Alto Next-Gen Firewall [panw]

### Dataset Name

logs-panw.panos@package

### Integration Version

5.3.3

### Agent Version

8.18.7

### Agent Output Type

elasticsearch

### Elasticsearch Version

8.18.0

### OS Version and Architecture

rhel 8

### Software/API Version

_No response_

### Error Message

"error": {
"message": [
"syslog failed to process field \"message\": validation error at position 1: parsing time \"965\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"965\" as \"2006\"",
"Provided Grok expressions do not match field value: [2025-09-23T07:10:09-04:00 [REDACTED_HOSTNAME] 1,2025/09/23 - - - 07:10:08,015701001753,TRAFFIC,end,2562,2025/09/23 07:10:08,[REDACTED_SRC_IP],[REDACTED_DST_IP],0.0.0.0,0.0.0.0,untrust-trust_any-any-allow,,,ssl,vsys1,untrust,trust,ethernet1/22,ethernet1/21,[REDACTED_LOG_SOURCE],2025/09/23 07:10:08,10560456,1,[REDACTED_SPORT],10003,0,0,0x10041a,tcp,allow,2150,858,1292,12,2025/09/23 07:09:33,20,government,,[REDACTED_SESSION_ID],0x8000000000000000,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,,7,5,tcp-rst-from-client,14,0,0,0,,[REDACTED_HOSTNAME],from-policy,,,0,,0,,N/A,0,0,0,0,8528391c-573f-4946-bc8d-e9e98c126b4f,0,0,,,,,,,,,Personal Computer,Dell Computer,,Dell,Windows,,[REDACTED_HOST_ID],[REDACTED_MAC],Virtual Machine,VMware,,\"VMware, Inc.\",,,[REDACTED_MAC],[REDACTED_MAC],,,,,,,,,,,2025-09-23T07:10:09.157-04:00,,,encrypted-tunnel,networking,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,ssl,no,no,0] grok"
]

### Event Original

"original": "965 <166>1 2025-09-23T07:10:09-04:00 [REDACTED_HOSTNAME] 1,2025/09/23 - - - 07:10:08,015701001753,TRAFFIC,end,2562,2025/09/23 07:10:08,[REDACTED_SRC_IP],[REDACTED_DST_IP],0.0.0.0,0.0.0.0,untrust-trust_any-any-allow,,,ssl,vsys1,untrust,trust,ethernet1/22,ethernet1/21,[REDACTED_LOG_SOURCE],2025/09/23 07:10:08,10560456,1,[REDACTED_SPORT],10003,0,0,0x10041a,tcp,allow,2150,858,1292,12,2025/09/23 07:09:33,20,government,,[REDACTED_SESSION_ID],0x8000000000000000,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,,7,5,tcp-rst-from-client,14,0,0,0,,[REDACTED_HOSTNAME],from-policy,,,0,,0,,N/A,0,0,0,0,[REDACTED_HOST_ID],0,0,,,,,,,,,Personal Computer,Dell Computer,,Dell,Windows,,[REDACTED_HOST_ID],[REDACTED_MAC],Virtual Machine,VMware,,\"VMware, Inc.\",,,[REDACTED_MAC],[REDACTED_MAC],,,,,,,,,,,2025-09-23T07:10:09.157-04:00,,,encrypted-tunnel,networking,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,ssl,no,no,0",
"timezone": "-04:00"

### What did you do?

nothing as yet

### What did you see?

{
"_index": ".ds-logs-panw.panos-default-2025.09.23-000429",
"_id": "AZl2diS20PlYxXDw_RQo",
"_version": 1,
"_source": {
"@timestamp": "2025-09-23T12:05:29.609Z",
"agent": {
"ephemeral_id": "[REDACTED_EPHEMERAL_ID]",
"id": "[REDACTED_AGENT_ID]",
"name": "[REDACTED_AGENT_NAME]",
"type": "filebeat",
"version": "8.18.7"
},
"data_stream": {
"dataset": "panw.panos",
"namespace": "default",
"type": "logs"
},
"ecs": {
"version": "8.17.0"
},
"elastic_agent": {
"id": "[REDACTED_ELASTIC_AGENT_ID]",
"snapshot": false,
"version": "8.18.7"
},
"error": {
"message": [
"syslog failed to process field \"message\": validation error at position 1: parsing time \"965\" as \"2006-01-02T15:04:05.999999999Z07:00\": cannot parse \"965\" as \"2006\"",
"Provided Grok expressions do not match field value: [2025-09-23T07:10:09-04:00 [REDACTED_HOSTNAME] 1,2025/09/23 - - - 07:10:08,015701001753,TRAFFIC,end,2562,2025/09/23 07:10:08,[REDACTED_SRC_IP],[REDACTED_DST_IP],0.0.0.0,0.0.0.0,untrust-trust_any-any-allow,,,ssl,vsys1,untrust,trust,ethernet1/22,ethernet1/21,[REDACTED_LOG_SOURCE],2025/09/23 07:10:08,10560456,1,[REDACTED_SPORT],10003,0,0,0x10041a,tcp,allow,2150,858,1292,12,2025/09/23 07:09:33,20,government,,[REDACTED_SESSION_ID],0x8000000000000000,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,,7,5,tcp-rst-from-client,14,0,0,0,,[REDACTED_HOSTNAME],from-policy,,,0,,0,,N/A,0,0,0,0,8528391c-573f-4946-bc8d-e9e98c126b4f,0,0,,,,,,,,,Personal Computer,Dell Computer,,Dell,Windows,,[REDACTED_HOST_ID],[REDACTED_MAC],Virtual Machine,VMware,,\"VMware, Inc.\",,,[REDACTED_MAC],[REDACTED_MAC],,,,,,,,,,,2025-09-23T07:10:09.157-04:00,,,encrypted-tunnel,networking,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,ssl,no,no,0] grok"
]
},
"event": {
"agent_id_status": "verified",
"created": "2025-09-23T12:05:29.609Z",
"dataset": "panw.panos",
"ingested": "2025-09-23T12:05:30Z",
"kind": "pipeline_error",
"original": "965 <166>1 2025-09-23T07:10:09-04:00 [REDACTED_HOSTNAME] 1,2025/09/23 - - - 07:10:08,015701001753,TRAFFIC,end,2562,2025/09/23 07:10:08,[REDACTED_SRC_IP],[REDACTED_DST_IP],0.0.0.0,0.0.0.0,untrust-trust_any-any-allow,,,ssl,vsys1,untrust,trust,ethernet1/22,ethernet1/21,[REDACTED_LOG_SOURCE],2025/09/23 07:10:08,10560456,1,[REDACTED_SPORT],10003,0,0,0x10041a,tcp,allow,2150,858,1292,12,2025/09/23 07:09:33,20,government,,[REDACTED_SESSION_ID],0x8000000000000000,10.0.0.0-10.255.255.255,10.0.0.0-10.255.255.255,,7,5,tcp-rst-from-client,14,0,0,0,,[REDACTED_HOSTNAME],from-policy,,,0,,0,,N/A,0,0,0,0,[REDACTED_HOST_ID],0,0,,,,,,,,,Personal Computer,Dell Computer,,Dell,Windows,,[REDACTED_HOST_ID],[REDACTED_MAC],Virtual Machine,VMware,,\"VMware, Inc.\",,,[REDACTED_MAC],[REDACTED_MAC],,,,,,,,,,,2025-09-23T07:10:09.157-04:00,,,encrypted-tunnel,networking,browser-based,4,\"used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use\",,ssl,no,no,0",
"timezone": "-04:00"
},
"input": {

### What did you expect to see?

{
"@timestamp": "2025-09-27T09:14:39.129-04:00",
"event": {
"action": "end",
"category": "network",
"type": "connection",
"outcome": "success",
"dataset": "panw.panos"
},
"source": {
"ip": "",
"port": ""
},
"destination": {
"ip": "",
"port": ""
},
"network": {
"transport": "tcp",
"protocol": "web-browsing",
"direction": "outbound"
},
"source.nat": {
"ip": "",
"port": ""
},
"destination.nat": {
"ip": "",
"port": ""
},
"panw.panos": {
"rule_name": "",
"vsys": "vsys1",
"source_zone": "inside",
"destination_zone": "outside",
"source_interface": "",
"destination_interface": "",
"action": "allow",
"bytes": "",
"packets": "",
"application": "web-browsing",
"category": "internet-utility",
"subcategory": "general-internet",
"risk": "4",
"threat_tags": [
"used-by-malware",
"able-to-transfer-file",
"has-known-vulnerability",
"tunnel-other-application",
"pervasive-use"
]
},
"host": {
"name": "",
"os": {
"name": "Windows",
"version": "10"
},
"mac": ""
}
}

### Anything else?

_No response_