What does this PR do?

This is a fix for #1296

So, because a handful of linux data streams are actually backed by the system module within metricbeat, they'll break the mapping, since they'll report event.module as system and not linux. This adds a processor to said data streams, so we can drop the event in ingest, and then the proper value is inserted in the mapping.

This is a (somewhat) temporary workaround, as eventually the metricsets will be migrated to linux.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.

How to test this PR locally

• Pull down and build
• On a linux host, run the elastic stack, add the linux integration and enable the entropy, network_summary, service, socket and users data streams. Note: users and service won't work if you're running the agent from inside a docker container
• Make sure the agent is healthy and all the data streams are collecting data.