auditbeat/module/auditd: add ignore_errors config option

[efd6]

Proposed commit message

Setting ignore_errors to true allows incompletely valid rule sets to be
used in a configuration. This is equivalent to the -i flag of auditctl.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

In auditbeat/module/auditd, run go test -v -run TestConfig/ValidateWithError. Both tests should pass and the second should emit a warning log line similar to this

{"log.level":"warn","@timestamp":"2023-10-16T09:41:28.941+1030","log.logger":"auditd","log.origin":{"file.name":"auditd/config.go","file.line":232},"message":"errors loading rules: 3 errors: at (audit_rules at auditbeat.yml):1: failed to parse rule '-x bad -F flag': flag provided but not defined: -x; at (audit_rules at auditbeat.yml):2: failed to parse rule '-a always,exit -w /etc/passwd': mutually exclusive flags uses together (file watch [-w|-p] and audit rule [-a|-A|-S|-C|-F]); at (audit_rules at auditbeat.yml):3: failed to interpret rule '-a always,exit -S fake -k exec': failed to add syscall 'fake': unknown syscall 'fake' for arch x86_64","ecs.version":"1.6.0"}

Related issues

• Closes [Auditbeat] Add ignore errors in audit rules #15768

Use cases

Screenshots

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Duration: 45 min 15 sec

❕ Flaky test report

No test was executed to be analysed.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[kgeller]

just out of curiousity, why %v here for the error? I was under the impression %w was intended for printing errors

[andrewkroh]

%w is only for use with https://pkg.go.dev/fmt#Errorf when wrapping errors.

[kgeller]

LGTM