[ProxySG] Support 'bcreportermain_v1', 'bcreporterssl_v1', and 'ssl' formats

[mjwolf]

Proposed commit message

In the ProxySG integration, add support for 'bcreportermain_v1', 'bcreporterssl_v1', and 'ssl' log formats. These formats are defined here: https://techdocs.broadcom.com/us/en/symantec-security-software/web-and-network-security/edge-swg/7-3/getting-started/page-help-administration/page-help-logging/log-formats/default-formats.html

As it's not possible to automatically detect what log format is being used, users of the integration will need to select the log format to be processed beforehand when setting up the input (this selector dropdown already exists, but previously only had one option).

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[taylor-swanson]

I'm still looking through this, but had one question (apologies in advance if I already asked this on the first proxysg review).

With regard to the access log format, is it expected that the stream of events we receive will only be in one format? Would we ever need to detect which format it is and handle accordingly?

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 06d9fc2

History

• 💚 Build #17826 succeeded f261253
• 💔 Build #17821 failed 07121fe
• 💚 Build #17788 succeeded 39fa60a
• 💔 Build #17787 failed da712ea
• 💔 Build #17785 failed 59fc750

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
94.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[mjwolf]

I'm still looking through this, but had one question (apologies in advance if I already asked this on the first proxysg review).

With regard to the access log format, is it expected that the stream of events we receive will only be in one format? Would we ever need to detect which format it is and handle accordingly?

Yes, the logs stream will only send the single configured format.

Since the log format is basically CSV, with no key names, I think it would be very difficult to automatically detect the format being used. A lot of them are similar, with a few differences that would be difficult to detect. I think any automatic detection would be unreliable, so instead the user will have to set up the log format in the input config ahead of time.

[elastic-vault-github-plugin-prod]

Package proxysg - 0.2.0 containing this change is available at https://epr.elastic.co/search?package=proxysg