Convert Filebeat haproxy.log to ECS

[webmat]

Caveats

• haproxy.client.ip is not renamed. If it's an IP, it's copied to source.ip,
  otherwise copied to source.domain.
• haproxy.source is the source's hostname, but Filebeat is already populating
  host.hostname, so leaving as haproxy.source.
• In the httplog format, the HTTP request is not being parsed/extracted.
  This PR does not change this fact, as it's a translation to ECS, not general improvements.

Renames

• haproxy.client.port => source.port
• haproxy.process_name => process.name
• haproxy.pid => process.pid
• haproxy.destination.ip => destination.ip
• haproxy.destination.port => destination.port
• haproxy.geoip.* => source.geo.*

TODO

• Convert pid and port to int
• Update ECS-migration.yml file
• Changelog
• Create field aliases

[ruflin]

Don't forget the ecs-migration.yml file.

[ruflin]

So this assume in some cases this is actually not an ip?

[webmat]

In HAProxy's case, they're too performance-conscious for this to be a name resolved from a reverse DNS query. However this can be populated with text if the connection is coming from a Unix socket LOL

[ruflin]

Unix socket info seems to be one more new twist on the IP field :-(

[webmat]

@ruflin Ready for review. Make sure to check out caveats.

[ruflin]

For the Caveats:

• client.ip: SGTM for now
• user_agent: See other PR
• haproxy.source: I think it's ok that we overwrite the host.* object.
• +1 on not making additional changes

[webmat]

@ruflin Looking at the test data we have, I would not use haproxy.source to overwrite host.hostname, after all. I don't want to overwrite a perfectly good hostname with 127.0.0.1 :-)

[ruflin]

@webmat SGTM. I assume only thing holding this one back from merging is field aliases?

[webmat]

@ruflin Yes, aliases are the only thing missing. Before I go ahead and add them here, can you check out this comment: #9135 (comment)? I've tried creating aliases, and there are issues.

[ruflin]

@webmat I assume our offline conversation resolved this. Let me know when this one is ready for an other round.

[webmat]

This PR is ready for final review.

Note that on top of ECS migration, now pid and port fields are cast to int in event body (they were strings).