[aws] Update AWS ALB Grok patterns to parse logs with conn_trace_id field and malformed requests missing HTTP versions

[devamanv]

Proposed commit message

The PR contains changes to modify the AWS ALB Grok pattern to support the conn_trace_id field and parse malformed requests missing HTTP versions, which is as follows:

http 2025-05-01T11:24:32.748149Z app/internal-service-alb/abcd1234efgh5678 127.0.0.1:57273 - -1 -1 -1 200 - 0 272 "- http://internal-service-alb.example.com:80-/ " "-" - - - "-" "-" "-" - 2025-05-01T11:24:32.720000Z "-" "-" "-" "-" "-" "-" "-" TID_00000000000000000000000000000000

Reference: AWS ELB Access Log entries

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• All pipeline tests should still pass

Related issues

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package aws 👍(14) 💚(5) 💔(3)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
cloudwatch_logs	1e+06	500000	-500000 (-50%)	💔
elb_logs	4739.34	577.03	-4162.31 (-87.82%)	💔
emr_logs	20000	13513.51	-6486.49 (-32.43%)	💔

To see the full report comment with /test benchmark fullreport

[jsevidal13]

Hello team! The customer mentioned in https://github.com/elastic/sdh-beats/issues/6770 is waiting for this PR to be merged before I can close out their support case.

Is there an ETA I could share with them on when this can be merged? 🙏

[devamanv]

@jsevidal13 we are trying to close it ASAP, hopefully by end of this week. Hope that's okay.

[jsevidal13]

@jsevidal13 we are trying to close it ASAP, hopefully by end of this week. Hope that's okay.

Thanks, @devamanv! I'll let the customer know.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: beee649

History

• 💚 Build #36251 succeeded 3ff2ee3
• 💚 Build #36106 succeeded ebde45f
• 💚 Build #36080 succeeded d215f96

[elastic-vault-github-plugin-prod]

Package aws - 5.6.0 containing this change is available at https://epr.elastic.co/package/aws/5.6.0/