Restore code review changes (elastic#17539)

* Comment to clarify why FIPS flag is not needed for smoke tests

* Use full versions of docker commands for readability

* Simplify grock pattern match

The grok pattern is unanchored-by-default, we don't need the leading and trailing
wildcards.

Author: donoghuc

.buildkite/pull_request_pipeline.yml

@@ -166,6 +166,8 @@ steps:
       # Run the smoke tests on the PR code
       docker tag docker.elastic.co/logstash/logstash-observability-sre:$${QUALIFIED_VERSION} \
         pr-built-observability-sre-image
+      # observabilitySREsmokeTests orchestrates FIPS-mode docker images
+      # and validates assertions separately, so it does not need FIPS flag.
       ./gradlew observabilitySREsmokeTests --stacktrace
 
   - label: ":lab_coat: Integration Tests - FIPS mode / part 1-of-3"

x-pack/build.gradle

@@ -89,7 +89,7 @@ tasks.register("observabilitySREsmokeTests", Test) {
         }
         def result = exec {
             workingDir file("distributions/internal/observabilitySRE/qa/smoke/docker")
-            commandLine 'docker-compose', 'up', '-d'
+            commandLine 'docker-compose', 'up', '--detach'
             ignoreExitValue = true
         }
         if (result.exitValue != 0) {
@@ -107,7 +107,7 @@ tasks.register("observabilitySREsmokeTests", Test) {
     doLast {
         exec {
             workingDir file("distributions/internal/observabilitySRE/qa/smoke/docker")
-            commandLine 'docker-compose', 'down', '-v'
+            commandLine 'docker-compose', 'down', '--volumes'
             ignoreExitValue = true
         }
         // Clean up the generated certificates

x-pack/distributions/internal/observabilitySRE/qa/smoke/docker/logstash/pipeline/logstash.conf

@@ -38,7 +38,7 @@ filter {
 
   if [log_content] =~ /json=/ {
     grok {
-      match => { "log_content" => ".*json=%{GREEDYDATA:json_string}.*" }
+      match => { "log_content" => "json=%{GREEDYDATA:json_string}" }
     }
     json {
       source => "json_string"