title: Wazuh child decoder not parsing field correctly
body: <p>I am trying to parse a log as shown below with a child decoder in wazuh 4.x, for some reason its not parsing the needed field</p>
  <p>Log entry</p>
  <pre><code>ossec: output: 'domainjoin-cli query|grep -i Domain': Domain = mydomain.local
  </code></pre>
  <p>Child Decoder</p>
  <pre><code>&lt;decoder name=&quot;ossec-domain&quot;&gt;
    &lt;parent&gt;ossec&lt;/parent&gt;
    &lt;type&gt;ossec&lt;/type&gt;
    &lt;prematch&gt;^ossec: output:&lt;/prematch&gt;
    &lt;regex type=&quot;pcre2&quot;&gt;^'domainjoin-cli[ \t]query|grep[ \t]-i[ \t]Domain':[ \t]Domain[ \t]=[ \t](\S+)&lt;/regex&gt;
    &lt;order&gt;domain&lt;/order&gt;
  &lt;/decoder&gt;
  </code></pre>
  <p>Output</p>
  <pre><code>ossec: output: 'domainjoin-cli query|grep -i Domain': Domain = mydomain.local
  
  **Phase 1: Completed pre-decoding.
          full event: 'ossec: output: 'domainjoin-cli query|grep -i Domain': Domain = mydomain.local'
  
  **Phase 2: Completed decoding.
          name: 'ossec'
          parent: 'ossec'
  
  **Phase 3: Completed filtering (rules).
          id: '100008'
          level: '3'
          description: 'Server is in  domain '
          groups: '['ossec']'
          firedtimes: '1'
          hipaa: '['164.312.b']'
          mail: 'False'
          pci_dss: '['10.6.1']'
  **Alert to be generated.
  </code></pre>