[Filebeat] Add timezone config option to decode_cef and syslog input

[andrewkroh]

What does this PR do?

CEF messages that contain timestamps without a timezone were parsed as UTC. The time zone was not
configurable. This adds a timezone option to the decode_cef processor and cef module to allow the
time zone to be specified when a timestamp does not contain an offset or zone.

CEF:0|Aruba Networks|ClearPass|6.8.7.120583|2002|RADIUS Accounting|1|rt=Aug 04 2021 11:31:15

This also replaces the deprecated import "4d63.com/tz" with Go's relatively new built-in
time/tzdata package. The timestamp processor was updated.

While I was adding the a timezone config type I made the syslog input's timezone configurable too.

Fixes #27232

Why is it important?

Timestamps were being interpreted incorrectly.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• Do a manual test of the module with netcat.

Related issues

• Closes Filebeat CEF module need the option to set a timezone or an offset #27232

Logs

2021-09-03T10:08:32.659-0400 DEBUG [processors] processors/processor.go:120 Generated new processors: rename=[{From:message To:event.original}], decode_cef={"Field":"event.original","TargetField":"cef","IgnoreMissing":false,"IgnoreFailure":false,"ID":"","ECS":true,"Timezone":"America/New_York"}, community_id=[target=network.community_id, fields=[source_ip=source.ip, source_port=source.port, destination_ip=destination.ip, destination_port=destination.port, transport_protocol=network.transport, icmp_type=icmp.type, icmp_code=icmp.code], seed=0], add_fields={"ecs":{"version":"1.11.0"}}

Manual test

filebeat.modules:
  - module: cef
    log:
      enabled: true
      var:
        syslog_host: localhost
        syslog_port: 9003
        timezone: America/New_York

output.console.pretty: true

{
  "@timestamp": "2021-08-04T15:31:15.000Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "8.0.0",
    "pipeline": "filebeat-8.0.0-cef-log-pipeline",
    "truncated": false
  },
  "input": {
    "type": "syslog"
  },
  "observer": {
    "vendor": "Aruba Networks",
    "product": "ClearPass",
    "version": "6.8.7.120583"
  },
  "message": "RADIUS Accounting",
  "ecs": {
    "version": "1.11.0"
  },
  "agent": {
    "type": "filebeat",
    "version": "8.0.0",
    "ephemeral_id": "e5b474fd-98af-44d6-9fae-a1cbdbee99f5",
    "id": "7292d176-7008-484e-b7d0-008ce53fe838",
    "name": "mac15"
  },
  "fileset": {
    "name": "log"
  },
  "cef": {
    "extensions": {
      "deviceReceiptTime": "2021-08-04T15:31:15.000Z"
    },
    "version": "0",
    "device": {
      "vendor": "Aruba Networks",
      "product": "ClearPass",
      "version": "6.8.7.120583",
      "event_class_id": "2002"
    },
    "name": "RADIUS Accounting",
    "severity": "1"
  },
  "log": {
    "source": {
      "address": "127.0.0.1:60040"
    }
  },
  "tags": [
    "cef",
    "forwarded"
  ],
  "service": {
    "type": "cef"
  },
  "event": {
    "severity": 1,
    "module": "cef",
    "dataset": "cef.log",
    "original": "CEF:0|Aruba Networks|ClearPass|6.8.7.120583|2002|RADIUS Accounting|1|rt=Aug 04 2021 11:31:15",
    "code": "2002"
  }
}

[botelastic]

This pull request doesn't have a Team:<team> label.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-09-03T18:23:58.087+0000

• Duration: 234 min 45 sec

• Commit: ffcfd85

Test stats 🧪

Test	Results
Failed	0
Passed	53858
Skipped	5325
Total	59183

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	53858
Skipped	5325
Total	59183

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

run tests