[System]: Ecs Fields are not populated and group.name is not extracted from Raw message

### Integration Name

System [packages/system]

### Dataset Name

system.auth

### Integration Version

2.20.0

### Agent Version

8.15.5

### Agent Output Type

logstash

### Elasticsearch Version

9.3.3

### OS Version and Architecture

linux, kubernetes

### Software/API Version

NA

### Error Message

No error message.

### Event Original

Jul 1 10:56:50 host1 groupadd[3829308]: group added to /etc/gshadow: name=fleet
Jul 1 11:05:59 host1 groupdel[3870987]: group 'fleet' removed from /etc/gshadow

### What did you do?

elastic agent -> logstash -> kafka -> logstash -> elasticsearch

### What did you see?

**Observed Behavior**

group.name is missing in the parsed document despite the value being present in the raw log.
event.action is missing for both groupadd and groupdel events.

### What did you expect to see?

Expected Behavior

The parser should extract and populate:

group.name: if its present
event.action: when its possible to add ( group-add or group_add
event.action: when its possible to add ( for eg. group-deletion or group_del )

### Anything else?

_No response_