[Cisco ASA] IPsec Event parsing failing "object mapping for [network.inner] tried to parse field [inner]"

[matthiasledergerber]

We are currently using the Cisco ASA Integration to parse syslog messages.

Elastic-Stack: 7.16.2
Beats-Agent: 7.16.2
Cisco ASA Integration: 1.3.2

However, when recieving IPsec messages the Elastic-Agent Publisher fails with the following message:

Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Date(2022, time.January,
        25,
        14,
        53,
        25,
        169746713, time.Local), Meta: {
            "raw_index": "logs-cisco_asa.log-default",
            "truncated": false
        }, Fields: {
            "agent": {
                "ephemeral_id": "e22b72b3-538e-4a1b-b902-382b184abce1",
                "hostname": "AAR0055N",
                "id": "2c334692-54c8-462f-be0c-227c8038dec2",
                "name": "HOSTNAME",
                "type": "filebeat",
                "version": "7.16.2"
            },
            "data_stream": {
                "dataset": "cisco_asa.log",
                "namespace": "default",
                "type": "logs"
            },
            "ecs": {
                "version": "1.12.0"
            },
            "elastic_agent": {
                "id": "2c334692-54c8-462f-be0c-227c8038dec2",
                "snapshot": false,
                "version": "7.16.2"
            },
            "event": {
                "dataset": "cisco_asa.log",
                "timezone": "+01:00"
            },
            "input": {
                "type": "udp"
            },
            "log": {
                "source": {
                    "address": "10.10.10.10:514"
                }
            },
            "message": "\u003c166\u003eJan 25 2022 13:53:25 HOSTNAME : %ASA-6-602303: IPSEC: An inbound LAN-to-LAN SA (SPI= 0xD565F968) between 1.1.1.1 and 2.2.2.2 (user= DefaultL2LGroup) has been created.\n",
            "tags": [
                "preserve_original_event",
                "cisco-asa",
                "forwarded"
            ]
        }, Private:interface {}(nil), TimeSeries: false
    }, Flags: 0x1, Cache:publisher.EventCache{m:common.MapStr(nil)
    }
} (status=400): {
    "type": "mapper_parsing_exception",
    "reason": "object mapping for [network.inner] tried to parse field [inner] as object, but found a concrete value"
}, dropping event!

Everything else parses fine. The Events have all the same structure described in the message field

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[leehinman]

The fix for this is in beats elastic/beats#26879

And issue to track backporting changes is here #2116