[Filebeat] Incorrect event.type in auditd module

[andrewkroh]

The auditd module uses several event.type values that are not in ECS.

beats/filebeat/module/auditd/log/ingest/pipeline.yml

Lines 138 to 157 in 778a92f

	- set:
	if: "ctx.auditd.log?.record_type == 'USER_AUTH'"
	field: event.type
	value: authentication
	- set:
	if: "ctx.auditd.log?.record_type == 'KERN_MODULE'"
	field: event.type
	value: driver
	- set:
	if: "ctx.auditd.log?.record_type == 'SOFTWARE_UPDATE'"
	field: event.type
	value: package
	- set:
	if: "ctx.auditd.log?.record_type == 'SYSTEM_BOOT' || ctx.auditd.log?.record_type == 'SYSTEM_SHUTDOWN'"
	field: event.type
	value: host
	- set:
	if: "ctx.auditd.log?.record_type == 'SYSCALL' && ctx.auditd.log?.syscall == 'execve'"
	field: event.type
	value: process

https://www.elastic.co/guide/en/ecs/current/ecs-allowed-values-event-type.html

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)