Winlogbeat - Select events by level, event_id, and provider

[andrewkroh]

This PR adds the ability to do select specific events from a single log. This is implemented using an event log query.

Sample Winlogbeat Config:

winlogbeat:
  event_logs:
    - name: Security
      include_xml: true
      level: info
      event_id: 4624, 4625, 4648, 4735, 4728, 4732, 4756, 4740
      provider:
        - Microsoft-Windows-Security-Auditing

XPath Query Used by Winlogbeat:

<QueryList>
  <Query Id="0">
    <Select Path="Security">*[System[(EventID=4624 or EventID=4625 or 
                  EventID=4648 or EventID=4735 or EventID=4728 or EventID=4732 or 
                  EventID=4756 or EventID=4740) and (Level = 0 or Level = 4) and 
                  Provider[@Name='Microsoft-Windows-Security-Auditing']]]
    </Select>
  </Query>
</QueryList> 

[ruflin]

Is there a reason to completely remove it?

[andrewkroh]

The system tests are all (now) skipped unless the OS is windows so I want it removed to use less Travis resources.

[ruflin]

Doesn't this require also an updates to beat.yml ?

[andrewkroh]

Yeah, I should update beat.yml with the new options. 👍 Will do.

[andrewkroh]

I updated the config file to include a mention of all the configuration options and added a link to the documentation.

[tsg]

LGTM, merging.