Fix sudo auth parsing without TTY

[hellqvio86]

Type of change

Bug

Proposed commit message

Fix system auth sudo parsing without TTY

Sudo log messages do not always include a TTY field, particularly when
sudo is invoked non-interactively. The auth ingest pipeline now treats the
TTY section as optional while preserving the existing parsing of TTY and sudo
error messages.

The sudo error pattern excludes values beginning with TTY= so existing
messages continue to populate system.auth.sudo.tty correctly. When TTY is
absent, system.auth.sudo.tty remains absent rather than being populated with
a placeholder value.

Added a pipeline test fixture covering:

Aug 6 19:42:10 server01 sudo[18432]: alice : PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/id

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• This change affects the log-based auth data stream; no metrics data streams were changed.
• I have added an entry to the package's changelog.yml file.
• No Kibana assets or version constraints are

[elastic-vault-github-plugin-prod]

Reviewers

Buildkite won't run for external contributors automatically; you need to add a comment:

• /test : will kick off a build in Buildkite.

NOTE: https://github.com/elastic/integrations/blob/main/.buildkite/pull-requests.json contains all those details.

[stanek-michal]

/test

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 5646e59

[stanek-michal]

LGTM, good to merge, thanks!

[elastic-vault-github-plugin-prod]

Package system - 2.22.3 containing this change is available at https://epr.elastic.co/package/system/2.22.3/