Make RDS regex more resilient (DataDog#22835)

* Make RDS regex more verbose

It was missing a group and actually failed to match anything in prod.
Because I overrode the org2 pattern in staging (and prod), I didn't
notice I forgot to update this generally until we started testing other
orgs. This doesn't break existing uses of this pattern as they aren't
matching anything at all to begin with.

* Add test

* Add second test

* Fix test

* Fix second test

Author: jasonmp85

postgres/assets/logs/postgresql.yaml

@@ -72,9 +72,9 @@ pipeline:
           suggested_format %{_prefix} %{_severity}:\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg})
 
           #See RDS documentation for more data-rich format
-          enhanced_rds_with_duration %{_timestamp_ms}:%{_client_ip}\(%{port:network.client.port:integer}\):%{_user}@%{_database}:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname})?:%{_severity}:\s+duration:\s+%{_duration}\s+ms\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg})
+          enhanced_rds_with_duration %{_timestamp_ms}:%{_client_ip}\(%{port:network.client.port:integer}\):%{_user}@%{_database}:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname})?:%{_severity}:\s*(%{integer}:\s*)?duration:\s+%{_duration}\s+ms\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg})
 
-          enhanced_rds %{_timestamp_ms}:%{_client_ip}\(%{port:network.client.port:integer}\):%{_user}@%{_database}:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname})?:%{_severity}:\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg})
+          enhanced_rds %{_timestamp_ms}:(%{_client_ip}\(%{port:network.client.port:integer}\))?:(%{_user})?@(%{_database})?:\[%{_proc_id}\]:%{integer:session_lineno}:%{notSpace:sql_state}:%{_betimestamp}:%{regex("[^:]+"):postgres.vxid}:%{regex("[^:]+"):postgres.xid}:%{regex("[^:]+"):postgres.session_id}:(%{regex("[^:]+"):postgres.appname}:)?%{_severity}:\s*(%{integer}:\s*)?(%{regex("statement:")}\s+%{_raw_query}|%{data:msg})
 
           default_format (%{_timestamp}|%{_timestamp_ms} \[%{_proc_id}])\s+%{_severity}:\s+(%{regex("statement:")}\s+%{_raw_query}|%{data:msg})
 

postgres/assets/logs/postgresql_tests.yaml

@@ -118,3 +118,52 @@ tests:
      - "source:LOGS_SOURCE"
      - "db:postgres"
     timestamp: 1758047205429
+ -
+  sample: "2025-11-19 18:27:10.640 UTC:10.198.137.95(54414):service_catalog_rw@service_catalog:[194370]:4:00000:2025-11-19 18:21:43 UTC:15/174689:276953619:691e0ab7.2f742:PostgreSQL JDBC Driver:LOG:  duration: 1626.107 ms  plan: {}"
+  result:
+    custom:
+      db:
+        backend_start: 1763576503000
+        date: 1763576830640
+        instance: "service_catalog"
+        severity: "LOG"
+        user: "service_catalog_rw"
+      duration: 1.626107E9
+      network:
+        client:
+          ip: "10.198.137.95"
+          port: 54414
+      postgres:
+        appname: "PostgreSQL JDBC Driver"
+        proc_id: "194370"
+        session_id: "691e0ab7.2f742"
+        vxid: "15/174689"
+        xid: "276953619"
+      session_lineno: 4
+      sql_state: "00000"
+    message: "plan: {}"
+    status: "info"
+    tags:
+     - "source:LOGS_SOURCE"
+     - "db:service_catalog"
+    timestamp: 1763576830640
+ -
+  sample: "2025-12-03 19:59:40.415 UTC::@:[1670514]:1:00000:2025-12-03 19:59:26 UTC:20/120887:0:6930969e.197d72:LOG:  automatic vacuum of table \"dm_v0.stream_router.kv_shadow_entei\": index scans: 1"
+  result:
+    custom:
+      db:
+        backend_start: 1764791966000
+        date: 1764791980415
+        severity: "LOG"
+      postgres:
+        proc_id: "1670514"
+        session_id: "6930969e.197d72"
+        vxid: "20/120887"
+        xid: "0"
+      session_lineno: 1
+      sql_state: "00000"
+    message: "automatic vacuum of table \"dm_v0.stream_router.kv_shadow_entei\": index scans: 1"
+    status: "info"
+    tags:
+     - "source:LOGS_SOURCE"
+    timestamp: 1764791980415