filebeat/module/cef: import genericised cef dashboards from integrations

[efd6]

What does this PR do?

This adds the dashboards that exist in the CEF integration to the CEF module in filebeat.

Why is it important?

The existing dashboards do not work in the general case as they were originally written against the ArcSight fields that the original module worked with.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• Query how to deal with the existing kibana/7 dashboards.

How to test this PR locally

Related issues

• Closes cef: make dashboard work with CEF standard inputs integrations#3469
• Relates cef: make general purpose dashboards integrations#3526

Use cases

Screenshots

See screenshots in elastic/integrations#3526.

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-08-24T00:46:56.997+0000

• Duration: 86 min 58 sec

Test stats 🧪

Test	Results
Failed	0
Passed	2201
Skipped	166
Total	2367

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[efd6]

jitterbit/get-changed-files#4

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b i3469-cef upstream/i3469-cef
git merge upstream/main
git push upstream i3469-cef

[andrewkroh]

I think the dashboards require some changes to work with Beats.

• Beats uses event.dataset instead of data_stream.dataset.
• The index pattern is filebeat-* rather than logs-*.
• Are the object IDs the same as what's in the Fleet integration? We should make them unique to prevent collisions Kibana with Fleets saved objects.

[efd6]

I have deconflicted the object IDs with clonedash (second commit) and the index patterns have been adjusted (last commit). I'll look into the data_stream.dataset => event.dataset.

What may still be an issue is that the beats dashboards have version and updated_at fields which I clobbered when I used clonedash. This can be repaired by passaging through filebeat export again.