checkpoint: Fix parsing error due to trailing spaces

packages/checkpoint/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.3.6"
+  changes:
+    - description: Fixed parsing error when logs have trailing spaces
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/3035
 - version: "1.3.5"
   changes:
     - description: Added link to check point documentation.

packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-trailing-space.log

@@ -0,0 +1 @@
+<134>1 2020-03-29T13:20:47Z gw-da58d3 CheckPoint 1930 - [action:"Accept"; flags:"444676"; ifdir:"outbound"; ifname:"eth0"; logid:"0"; loguid:"{0x5e80a0af,0x3,0xbba3afa,0xd2c10858}"; origin:"192.168.1.100"; originsicname:"cn=cp_mgmt,o=gw-da58d3..tmn8s8"; sequencenum:"5"; version:"5"; __policy_id_tag:"product=VPN-1 & FireWall-1[db_tag={AFDE1595-0AEA-6E48-B48E-A69F8263607D};mgmt=gw-da58d3;date=1585488025;policy_name=Standard\]"; dst:"192.168.1.1"; inzone:"Local"; layer_name:"Network"; layer_uuid:"63b7fe60-76d2-4287-bca5-21af87337b0a"; match_id:"1"; parent_rule:"0"; rule_action:"Accept"; rule_uid:"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"; outzone:"Internal"; product:"VPN-1 & FireWall-1"; proto:"17"; s_port:"37029"; service:"53"; service_id:"domain-udp"; src:"192.168.1.100"]  

packages/checkpoint/data_stream/firewall/_dev/test/pipeline/test-trailing-space.log-expected.json

@@ -0,0 +1,73 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2020-03-29T13:20:47.000Z",
+            "checkpoint": {
+                "logid": "0",
+                "match_id": "1",
+                "parent_rule": "0",
+                "rule_action": "Accept"
+            },
+            "destination": {
+                "ip": "192.168.1.1",
+                "port": 53
+            },
+            "ecs": {
+                "version": "8.0.0"
+            },
+            "event": {
+                "action": "Accept",
+                "category": [
+                    "network"
+                ],
+                "id": "{0x5e80a0af,0x3,0xbba3afa,0xd2c10858}",
+                "kind": "event",
+                "original": "\u003c134\u003e1 2020-03-29T13:20:47Z gw-da58d3 CheckPoint 1930 - [action:\"Accept\"; flags:\"444676\"; ifdir:\"outbound\"; ifname:\"eth0\"; logid:\"0\"; loguid:\"{0x5e80a0af,0x3,0xbba3afa,0xd2c10858}\"; origin:\"192.168.1.100\"; originsicname:\"cn=cp_mgmt,o=gw-da58d3..tmn8s8\"; sequencenum:\"5\"; version:\"5\"; __policy_id_tag:\"product=VPN-1 \u0026 FireWall-1[db_tag={AFDE1595-0AEA-6E48-B48E-A69F8263607D};mgmt=gw-da58d3;date=1585488025;policy_name=Standard\\]\"; dst:\"192.168.1.1\"; inzone:\"Local\"; layer_name:\"Network\"; layer_uuid:\"63b7fe60-76d2-4287-bca5-21af87337b0a\"; match_id:\"1\"; parent_rule:\"0\"; rule_action:\"Accept\"; rule_uid:\"1fde807b-6300-4b1a-914f-f1c1f3e2e7d2\"; outzone:\"Internal\"; product:\"VPN-1 \u0026 FireWall-1\"; proto:\"17\"; s_port:\"37029\"; service:\"53\"; service_id:\"domain-udp\"; src:\"192.168.1.100\"]  ",
+                "outcome": "success",
+                "sequence": 5,
+                "type": [
+                    "allowed",
+                    "connection"
+                ]
+            },
+            "network": {
+                "application": "domain-udp",
+                "direction": "outbound",
+                "iana_number": "17",
+                "name": "Network",
+                "transport": "udp"
+            },
+            "observer": {
+                "egress": {
+                    "interface": {
+                        "name": "eth0"
+                    },
+                    "zone": "Internal"
+                },
+                "ingress": {
+                    "zone": "Local"
+                },
+                "name": "192.168.1.100",
+                "product": "VPN-1 \u0026 FireWall-1",
+                "type": "firewall",
+                "vendor": "Checkpoint"
+            },
+            "related": {
+                "ip": [
+                    "192.168.1.100",
+                    "192.168.1.1"
+                ]
+            },
+            "rule": {
+                "uuid": "1fde807b-6300-4b1a-914f-f1c1f3e2e7d2"
+            },
+            "source": {
+                "ip": "192.168.1.100",
+                "port": 37029
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
+        }
+    ]
+}

packages/checkpoint/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml

@@ -14,7 +14,7 @@ processors:
         - '%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-)
           +(?:%{IPORHOST:syslog5424_host}|-) +(-|%{SYSLOG5424PRINTASCII:syslog5424_app})
           +(-|%{SYSLOG5424PRINTASCII:syslog5424_proc}) +(?::-|%{SYSLOG5424PRINTASCII:syslog5424_msgid})
-          +\[%{GREEDYDATA:syslog5424_sd}\]$'
+          +\[%{GREEDYDATA:syslog5424_sd}\]'
   - kv:
       field: syslog5424_sd
       field_split: "; "

packages/checkpoint/manifest.yml

@@ -1,6 +1,6 @@
 name: checkpoint
 title: Check Point
-version: 1.3.5
+version: 1.3.6
 release: ga
 description: Collect logs from Check Point with Elastic Agent.
 type: integration