auditbeat,filebeat,packetbeat: format mac addresses according to ECS

[efd6]

What does this PR do?

This changes MAC address formatting to conform to the ECS specification.

Why is it important?

Currently MAC addresses are formatted in Go code using the net.HardwareAddr String method which does not conform to the ECS spec.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• In many cases hardware addresses are not generated by Go code. These cases are not handled in this change.
• The formatting function is simple and there is no obvious place to put it, so it is duplicated at use sites.

How to test this PR locally

Related issues

• Updates auditbeat,filebeat,packetbeat: mac addresses are not formatted according to ECS #32621

Use cases

Screenshots

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-08-23T21:54:44.053+0000

• Duration: 78 min 56 sec

Test stats 🧪

Test	Results
Failed	0
Passed	4147
Skipped	234
Total	4381

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 32621-all upstream/32621-all
git merge upstream/main
git push upstream 32621-all

[andrewkroh]

The CEF processor (keys.ecs.go) is producing several MACs. You can add a Translate function to the mappings for each that replaces colons with dashes.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 32621-all upstream/32621-all
git merge upstream/main
git push upstream 32621-all

[andrewkroh]

I doubt it matters, but none of the other Translate funcs mutate *cef.Field. They only return the modified value. Perhaps it should be a straight return without the set.

[efd6]

Fixed and added docs to mappedField.

Note for future: The mutation would be ineffective in this case.