Add common event format plugin

[ericwholt]

This plugin adds option to parse common event format logs. Currently it is not possible to parse the extensions without the addition of an operator. Supports syslog prefix with timestamp matching Jan 02 15:04:05 and a hostname.

[jsirianni]

Some thoughts

name --> message
device_ --> labels
hostname --> resource
signature. --> ??
version --> ??

Also, I will be building a key value parser, so we can handle extenssions.

[jsirianni]

We should have a user specified timezone parameter as the timestamps do not include one.

Sep 11 08:26:10 zurich CEF:0|security|threatmanager|1.0|100|worm successfully stopped|10|src=10.0.0.1 dst=2.1.2.2 spt=1232

[ericwholt]

Done

[ericwholt]

Removed key_value parser. Extensions format allows to many variations to parse using the parser.

[jsirianni]

Looks good. I need to find out if we want to promote device_vendor / device_version to labels.

[jsirianni]

Lets promote device_vendor / device_version to resources

[jsirianni]

{
  "timestamp": "2021-09-11T08:26:10Z",
  "severity": 70,
  "severity_text": "10",
  "labels": {
    "device": "threatmanager",
    "file_name": "cef.log",
    "log_type": "cef",
    "plugin_id": "common_event_format",
    "version": "0"
  },
  "resource": {
    "device_vendor": "security",
    "device_version": "1.0",
    "hostname": "zurich"
  },
  "record": {
    "extensions": "src=10.0.0.1 dst=2.1.2.2 spt=1232 ",
    "message": "worm successfully stopped",
    "signature_id": "100"
  }
}