[Cisco IOS]: Grok pattern failing on Cisco IOS XR 7 and higher

### Integration Name

Cisco IOS [cisco_ios]

### Dataset Name

cisco_ios.log

### Integration Version

1.34.0

### Agent Version

9.1.5

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.1.5

### OS Version and Architecture

Cisco IOS XR 7+

### Software/API Version

_No response_

### Error Message

pipeline_error

### Event Original

<187>Node1: 2026 Feb 6 09:35:02.059 CET: %DAEMON-3-SYSTEM_MSG: error: PAM: Authentication failure for ***** from 192.168.1.1 - dcos_sshd[27487]

### What did you do?

{
"policy_ids": [
"cisco_ios-logs_agent-policy"
],
"package": {
"name": "cisco_ios",
"version": "1.34.0"
},
"name": "Cisco IOS (Syslog)",
"description": "Cisco IOS log ingestion",
"namespace": "",
"inputs": {
"cisco_ios-tcp": {
"enabled": true,
"streams": {
"cisco_ios.log": {
"enabled": true,
"vars": {
"tags": [
"cisco-ios",
"forwarded"
],
"syslog_host": "0.0.0.0",
"syslog_port": 6514,
"preserve_original_event": true,
"tz_offset": "Europe/Stockholm",
"tz_map": "#- tz_short: CEST\n# tz_long: Europe/Stockholm\n",
"ssl": "certificate: \"/etc/elastic-agent/certs/tls.crt\"\nkey: \"/etc/elastic-agent/certs/tls.key\"\ncertificate_authorities: \"/etc/elastic-agent/certs/ca.crt\"",
"tcp_options": "#max_connections: 1\n#framing: delimiter\n#line_delimiter: \"\\n\"\n",
"processors": "- add_fields:\r\n target: labels\r\n fields:\r\n appname: Cisco IOS"
}
}
}
},
"cisco_ios-udp": {
"enabled": false
},
"cisco_ios-logfile": {
"enabled": false
}
},
"output_id": "internal-elasticsearch"
}

### What did you see?

The grok doesn´t work so host name etc. isn´t parsed.

### What did you expect to see?

A parsed message

### Anything else?

The issue seem to be with the [grok pattern](https://github.com/elastic/integrations/blob/9cd835bbf51e687475e5c1b62bb10634a8deea52/packages/cisco_ios/data_stream/log/elasticsearch/ingest_pipeline/default.yml#L64), I have modified it in our ingest pipeline to below and it has been running for 2 months without any noticeable problems. Got reminded of the issue when I upgraded the integration to 1.34.0.
> ^%{CISCO_PRIORITY_MSGCOUNT}?(?:(?:%{IP}|%{CISCO_HOSTNAME:log.syslog.hostname})(?:(:)? (\\*)?%{DATA}:|:?)?( )?)?(?:%{NUMBER:cisco.ios.sequence}: )?(?:%{CISCO_UPTIME:cisco.ios.uptime}|%{CISCO_TIMESTAMP:_temp_.timestamp}): %{GREEDYDATA:_temp_.message}$