[Packetbeat] Fix SIP parser logic related to line length check (elast…

…ic#23411)

* Since we're getting chars up to the start of CRLF, not the end

* Updated as suggested by andrewkroh

* Packetbeat bugfix - Fix SIP parser logic related to line length check

* Update SIP golden files to include 200 OK messages

Co-authored-by: Marc Guasch <marc.guasch@elastic.co>

CHANGELOG.next.asciidoc

@@ -482,6 +482,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 *Packetbeat*
 
+- Fix SIP parser logic related to line length check. {pull}23411[23411]
+
 
 *Winlogbeat*
 

packetbeat/protos/sip/parser.go

@@ -164,8 +164,9 @@ func (*parser) parseSIPLine(pi *parsingInfo, m *message) error {
 		err     error
 	)
 
+	const minStatusLineLength = len("SIP/2.0 XXX OK")
 	fline := pi.data[pi.parseOffset:i]
-	if len(fline) < 16 { // minimum line will be "SIP/2.0 XXX OK\r\n"
+	if len(fline) < minStatusLineLength {
 		if isDebug {
 			debugf("First line too small")
 		}