Beats: Add additional log types to the Filebeat Zeek Module

[n0othing]

Describe the enhancement:

Today, the Filebeat Zeek module supports the following log types:

• connection
• dns
• files
• https
• notice
• ssl

However, it would be useful to also collect:

• [x] dhcp
• [x] ftp
• [x] irc
• [x] kerberos
• [x] modbus
• [x] mysql
• [x] ntlm
• [x] radius
• [x] rdp
• [x] rfb
• [x] sip
• [x] smb_cmd
• [x] smtp
• [x] snmp
• [x] smb_mapping
• [x] smb_files
• [x] socks
• [x] ssh
• [x] syslog
• [x] intel
• [x] notice_alert
• [ ] signatures
• [ ] known_certs
• [ ] stdout
• [ ] stderr

[cwurm]

With the exception of intel and notice_alert all have been added with https://github.com/elastic/beats/pull/14150.

🎉 🎉 🎉

[lucabelluccini]

It would be great to add:

• known_certs
• stdout
• stderr

An exhaustive list of log files is available at https://docs.zeek.org/en/stable/script-reference/log-files.html

[andrewkroh]

intel.log was added in #14404 (targeted for v7.6.0).

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[BobBlank12]

ntp and packet_filter logs?

[111andre111]

I have now opened https://github.com/elastic/beats/issues/18868 because there are much more kinds of logs missing.

[andrewkroh]

I'm going to close this issue. Most of those have been implemented and we have a fresh list of all the remaining logs in https://github.com/elastic/beats/issues/18868.