[MetricBeat]set resource tags if dimension value is ARN

[kwinstonix]

Describe the enhancement:

If dimension value is ARN，then it should be processed by findIdentifierFromARN and check the resource identifier in resourceTagMap. I find this issue in AWS shield namespace metircs

beats/x-pack/metricbeat/module/aws/cloudwatch/cloudwatch.go

Lines 610 to 623 in 0c15394

	func insertTags(events map[string]mb.Event, identifier string, resourceTagMap map[string][]resourcegroupstaggingapi.Tag) {
	// Check if identifier includes dimensionSeparator (comma in this case),
	// split the identifier and check for each sub-identifier.
	// For example, identifier might be [storageType, s3BucketName].
	// And tags are only store under s3BucketName in resourceTagMap.
	subIdentifiers := strings.Split(identifier, dimensionSeparator)
	for _, v := range subIdentifiers {
	tags := resourceTagMap[v]
	if len(tags) != 0 {
	// By default, replace dot "." using underscore "_" for tag keys and values
	for _, tag := range tags {
	events[identifier].RootFields.Put("aws.tags."+common.DeDot(*tag.Key), common.DeDot(*tag.Value))
	}
	continue

beats/x-pack/metricbeat/module/aws/utils.go

Line 202 in 0c15394

func findIdentifierFromARN(resourceARN string) (string, error) {

• shield metric example

        {
            "Namespace": "DDoSProtection",
            "Dimensions": [
                {
                    "Name": "ResourceArn",
                    "Value": "arn:aws:ec2:ap-northeast-1:1111122222:elastic-ip/eipalloc-000aabbcccddd"
                },
                {
                    "Name": "AttackVector",
                    "Value": "GenericUDPReflection"
                }
            ],
            "MetricName": "DDoSAttackPacketsPerSecond"
        }

aws doc:
https://docs.aws.amazon.com/waf/latest/developerguide/monitoring-cloudwatch.html

[elasticmachine]

Pinging @elastic/integrations-platforms (Team:Platforms)