Add system test for Fortinet client endpoint

packages/fortinet/_dev/deploy/docker/Dockerfile

@@ -0,0 +1,5 @@
+FROM alpine
+
+COPY ./fortinet-clientendpoint.log /sample_logs/
+
+ENTRYPOINT [ "/bin/sh" ]

packages/fortinet/_dev/deploy/docker/docker-compose.yml

@@ -0,0 +1,8 @@
+version: '2.3'
+services:
+  fortinet:
+    tty: true
+    build: .
+    volumes:
+      - ${SERVICE_LOGS_DIR}:/logs
+    command: -c "cp /sample_logs/*.log /logs/"

packages/fortinet/data_stream/clientendpoint/_dev/test/system/config.yml

@@ -0,0 +1,6 @@
+input: logfile
+vars: ~
+data_stream:
+  vars:
+    paths:
+      - "{{SERVICE_LOGS_DIR}}/*clientendpoint*.log"

packages/fortinet/data_stream/clientendpoint/fields/ecs.yml

@@ -836,3 +836,9 @@
   ignore_above: 1024
   description: List of keywords used to tag each event.
   example: '["production", "env2"]'
+- name: ecs.version
+  type: keyword
+  description: ECS version this event conforms to.
+- name: related.hosts
+  type: keyword
+  description: All the host identifiers seen on your event.

packages/fortinet/docs/README.md

@@ -631,6 +631,7 @@ The `clientendpoint` dataset collects Fortinet FortiClient Endpoint Security log
 | dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword |
 | dns.answers.type | The type of data contained in this resource record. | keyword |
 | dns.question.type | The type of record being queried. | keyword |
+| ecs.version | ECS version this event conforms to. | keyword |
 | error.message | Error message. | text |
 | event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword |
 | event.code | Identification code for this event, if one exists. Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | keyword |
@@ -699,6 +700,7 @@ The `clientendpoint` dataset collects Fortinet FortiClient Endpoint Security log
 | process.pid | Process id. | long |
 | process.ppid | Parent process' pid. | long |
 | process.title | Process title. The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | keyword |
+| related.hosts | All the host identifiers seen on your event. | keyword |
 | related.ip | All of the IPs seen on your event. | ip |
 | related.user | All the user names seen on your event. | keyword |
 | rsa.counters.dclass_c1 | This is a generic counter key that should be used with the label dclass.c1.str only | long |