[iptables] Add journald input support iptables

[andrewkroh]

What does this PR do?

• Add journald input support.
• Format MAC addresses.
• Set event.created.
• Remove redundant event.ingested.
• Transition from experimental to beta.
• Add system test for journald input.
• Bump stack requirement to 7.16 to get journald input.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-01-13T14:34:52.265+0000

• Duration: 17 min 31 sec

• Commit: b518f7d

Test stats 🧪

Test	Results
Failed	0
Passed	28
Skipped	0
Total	28

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[efd6]

We are living in the future. Should the date parser attempt to make the date the last date that matches the log line as an attempt at sanity rather than the date of the current year that matches the log line or is this not a concern?

[andrewkroh]

FWIW this is the behavior of all the date processor implementations in our stack AFAIK.

There is no shortage of ways things can go wrong when you don't have a year in your timestamps. If you look in the logstash-filter-date repo you'll find some discussion.

[andrewkroh]

FWIW this is the behavior of all the date processor implementations in our stack AFAIK.

There is no shortage of ways things can go wrong when you don't have a year in your timestamps. If you look in the logstash-filter-date repo you'll find some discussion.