Filebeat Nginx Error ingest pipeline can't parse basic auth messages

[leweafan]

Describe the enhancement:

Nginx error ingest pipeline should be able to parse nginx event that basic auth failed. Now parsing doesn't contain fields:

• event.category = "authentication"
• event.action = "login-failed"
• event.outcome = "failure"
• user.name
• client.ip
• client.geo.*
• url.domain
• url.original
• http.request.referrer

Log message example:

2022/06/29 11:39:52 [error] 1342#0: *46339075 user "xxx" was not found in "/etc/nginx/conf.d/passwd", client: 10.10.10.10, server: , request: "GET /url/path/admin.css HTTP/1.0", host: "test.domain.com"
2022/06/30 17:14:22 [error] 764#764: *686 user "admin": password mismatch, client: 10.10.10.10, server: _, request: "GET / HTTP/1.1", host: "10.11.11.11"

Describe a specific use case for the enhancement or feature:

Elastic SIEM should be able to notify about failed nginx authentications.

Steps to reproduce

POST /_ingest/pipeline/filebeat-7.17.4-nginx-error-pipeline/_simulate
{
  "docs": [
    {
      "_source": {
        "@timestamp": "2022-06-29T11:39:52.178Z",
        "message" : "2022/06/29 11:39:52 [error] 1342#0: *46339075 user \"xxx\" was not found in \"/etc/nginx/conf.d/passwd\", client: 10.10.10.10, server: , request: \"GET /url/path/admin.css HTTP/1.0\", host: \"test.domain.com\""
      }
    }
  ]
}

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!