[Filebeat] Prevent mutable script params reference from leaking into pipeline

[andrewkroh]

What does this PR do?

A reference to a list contained in the script processor's params was
leaking into the rest of the pipeline and then being modified by later
processors. Now a copy of the List is written into the event.

For concurrent processing this resulted in ConcurrentModificationExceptions,
but I assume it led to incorrect event.type values in single worker deployments
because the params object was modified.

Why is it important?

This fixes processing issues when multiple workers or Filebeats are used.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewstucki]

Just wondering, did we try this out with multiple workers and a large-ish log input to make sure no concurrent modification exceptions were thrown?

[andrewkroh]

I ran a test using 16 workers and saw no error.message in events and no exceptions in the ES log.

filebeat.modules:
- module: suricata
  eve:
    enabled: true
    var.paths: [/Users/akroh/Downloads/eve.json-2020120917]

filebeat.overwrite_pipelines: true

output.elasticsearch:
  hosts: ["localhost:9200"]
  bulk_max_size: 1024
  worker: 16
  compression_level: 6
  username: elastic
  password: changeme

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #23534 updated

• • Start Time: 2021-01-15T16:28:48.712+0000

• Duration: 44 min 43 sec

• Commit: cb5e1e8

Test stats 🧪

Test	Results
Failed	0
Passed	5129
Skipped	574
Total	5703

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	5129
Skipped	574
Total	5703

[octavioranieri-zz]

FYI, below the tests ingesting a 4.7GB eve.json file with 16 workers, 0 failures for ~10kk events: