Describe the enhancement:

With the Azure Kubernetes Service diagnostic settings, I can push the k8s audit log into Elastic. The k8s audit log is json, by consequence the azure filebeat processor will output in the field message the k8s audit as a json string.

{
        "rename" : {
          "field" : "azure.platformlogs.properties.log",
          "target_field" : "message",
          "ignore_missing" : true
        }
      }

The improvement is about letting the user configure the Azure module to choose to parse azure.platformlogs.properties.log as json into a specific field.

Describe a specific use case for the enhancement or feature:

Ingesting AKS audit log