Cherry-pick of PR #26441 to 7.x branch. Original message:

What does this PR do?

Updates the Filebeat aws.elb module ingest pipeline to properly parse the request URL and user agent string.

Why is it important?

Currently the request URL is being recorded as the http.request.referer when per https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html#access-log-entry-syntax, its the actual request, not referer. This fixes that and parses the URL via the uri_parts processor.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

cd beats/x-pack/filebeat
TESTING_FILEBEAT_MODULES=aws TESTING_FILEBEAT_FILESETS=elb mage -v pythonIntegTest

Related issues

• Closes Filebeat AWS ELB ingest fields differ from Kibana Observability #26435

Use cases

Screenshots

Logs