What does this PR do?

Adds ECS 1.7 mime_type fields to the Elasticsearch audit log filebeat module and fixes a bug in the ingest pipeline that was truncating JSON payloads in the request_body field in plaintext audit logs.

I would imagine that this would result in a bit of a hit to the throughput of the module due to adding additional processing on the beats side to dice up and determine the mime type of the request. Initially I tried extracting the request_body from the plaintext payload with a beats-side dissect processor, but the lack of regex anchoring support causes it to misinterpret arrays inside a JSON request as terminators for the field itself, similar to how the unanchored grok in the pipeline was working. Since I couldn't get that to work properly, I just decided to drop into Javascript and anchor a regex that can extract the field.

If there are any alternatives that someone can think of, let me know.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Relates [ECS] Upgrade modules to 1.7 #21674