Add condition to a filtering rule

[monicasarbu]

Related to #451

If more filtering rules are defined, then they are executed in the order they are defined. The initial event is passed to the first filtering rule and what results from it is passed to the second filtering rule until all the filtering rules are applied. The condition that is used in the following filtering rules is running against the event that is received as input and it might defer from the original event.

Condition types:

• equals
• contains
• regexp
• range
• and
• or
• not

Equals

Accepts only integers and strings.

equals:
  type: process

equals:
  proc.name: test

equals:
  http.response.code: 200

Contains

Accepts only strings.

contains:
  proc.name: topbeat

Regexp

Accepts only strings that include a regular expression.

regexp:
  proc.name: "$beat"

Range

Accepts only integers and floats.

range:
  proc.cpu.total_p:
    gte: 0.5

range:
  responsetime:
    gte: 30

Combine two conditions

You can specify a list of conditions under each type and they are combined with and. For example, the following conditions selects the `type=process and proc.name=test:

equals:
  type: process
  proc.name: test

OR/AND/NOT operators

or/and/not:
  - <condition>
  - <condition>
  - <condition>

where <condition> can contain any of the actions vailable including other or, not, and.

Required changes:

• Add conditions Add condition to filters #1395
• Pluggable filtering rules Use dots in field names and make filters pluggable #1623
• Add operators Add OR/AND/NOT in the condition associated with the processors #1983
• Add drop_event action Use dots in field names and make filters pluggable #1623
• Add include_event action
• Be able to pass fields that contain . in the condition Use dots in field names and make filters pluggable #1623
• Add a sample example in libbeat.yml
• Add system tests for Topbeat, Packetbeat, Filebeat Use dots in field names and make filters pluggable #1623
• Update documentation to include conditions
• Add system tests for Metricbeat Use dots in field names and make filters pluggable #1623