[Filebeat] Add mime type detection for Elasticsearch module

[andrewstucki]

What does this PR do?

Adds ECS 1.7 mime_type fields to the Elasticsearch audit log filebeat module and fixes a bug in the ingest pipeline that was truncating JSON payloads in the request_body field in plaintext audit logs.

I would imagine that this would result in a bit of a hit to the throughput of the module due to adding additional processing on the beats side to dice up and determine the mime type of the request. Initially I tried extracting the request_body from the plaintext payload with a beats-side dissect processor, but the lack of regex anchoring support causes it to misinterpret arrays inside a JSON request as terminators for the field itself, similar to how the unanchored grok in the pipeline was working. Since I couldn't get that to work properly, I just decided to drop into Javascript and anchor a regex that can extract the field.

If there are any alternatives that someone can think of, let me know.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Relates [ECS] Upgrade modules to 1.7 #21674

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #22975 updated

• Start Time: 2020-12-08T17:33:41.060+0000

• Duration: 48 min 42 sec

Test stats 🧪

Test	Results
Failed	0
Passed	5093
Skipped	566
Total	5659

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	5093
Skipped	566
Total	5659

[leehinman]

LGTM