[Auditd]: Service.name is not populated.

### Integration Name

Auditd Logs [packages/auditd]

### Dataset Name

auditd.log

### Integration Version

3.23.2

### Agent Version

8.16.5

### Agent Output Type

logstash

### Elasticsearch Version

9.3.3

### OS Version and Architecture

Oracle Linux Server (86_64)

### Software/API Version

NA

### Error Message

No error.message.

### Event Original

type=SERVICE_STOP msg=audit(1785341073.141:92061): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rsyslog comm=""systemd"" exe=""/usr/lib/systemd/systemd"" hostname=? addr=? terminal=? res=success'

type=SERVICE_START msg=audit(1785341073.141:92061): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=rsyslog comm=""systemd"" exe=""/usr/lib/systemd/systemd"" hostname=? addr=? terminal=? res=success'

### What did you do?

Source Host -> Elastic Agent -> Logstash -> Kafka -> Logstash -> Elasticsearch

### What did you see?

During analysis of SERVICE_STOP audit events, we observed that the audit message contains the service/unit name:
unit=rsyslog

However, the parsed document does not populate the ECS field:

service.name

The event successfully extracts other fields,but the service identifier present in the raw event (unit=rsyslog) is not mapped to service.name.

As a result, the service that was stopped cannot be directly identified through ECS-compliant fields.

### What did you expect to see?

the ingestion pipeline should populate:

{
"service": {
"name": "rsyslog"
}
}

### Anything else?

_No response_

Start by inspecting the packages/auditd integration and the parsing entry points for SERVICE_STOP audit events. Trace how the unit=rsyslog value is handled, then verify that the resulting event exposes it as service.name and that the existing auditd checks still pass.

Written by the indexing model from the issue text.