[Filebeat] Improve ECS field mappings in aws module

CHANGELOG.next.asciidoc

@@ -127,6 +127,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add a TLS test and more debug output to httpjson input {pull}16315[16315]
 - Add an SSL config example in config.yml for filebeat MISP module. {pull}16320[16320] 
 - Improve ECS categorization, container & process field mappings in auditd module. {issue}16153[16153] {pull}16280[16280]
+- Improve ECS field mappings in aws module. {issue}16154[16154] {pull}16307[16307]
 
 *Heartbeat*
 

x-pack/filebeat/module/aws/elb/ingest/pipeline.yml

@@ -70,8 +70,8 @@ processors:
  %{ELBPROCESSINGTIME}
  ELBHTTPLOG: >-
  %{ELBCOMMON}
- %{NUMBER:http.response.status_code}
- (?:-|%{NUMBER:aws.elb.backend.http.response.status_code})
+ %{NUMBER:http.response.status_code:long}
+ (?:-|%{NUMBER:aws.elb.backend.http.response.status_code:long})
  %{NUMBER:http.request.body.bytes:long}
  %{NUMBER:http.response.body.bytes:long}
  \"(?:-|%{WORD:http.request.method}) (?:-|%{NOTSPACE:http.request.referrer}) (?:-|HTTP/%{NOTSPACE:http.version})\"
@@ -89,17 +89,53 @@ processors:
  ELBV2TYPE: '%{WORD:aws.elb.type}'
  ELBV2LOGVERSION: '%{NOTSPACE}' # Could be used to support different log versions, only 1.0 exists now
 
+ - set:
+ field: event.kind
+ value: event
+
+ - set:
+ field: cloud.provider
+ value: aws
 
  - set:
  if: 'ctx.http != null'
  field: 'aws.elb.protocol'
  value: 'http'
 
+ - set:
+ if: 'ctx.http != null'
+ field: event.category
+ value: web
+
  - set:
  if: 'ctx.http == null'
  field: 'aws.elb.protocol'
  value: 'tcp'
 
+ - set:
+ if: 'ctx.http == null'
+ field: event.category
+ value: network
+
+ - set:
+ if: 'ctx?.http?.response?.status_code != null && ctx.http.response.status_code < 400'
+ field: event.outcome
+ value: success
+
+ - set:
+ if: 'ctx?.http?.response?.status_code != null && ctx.http.response.status_code >= 400'
+ field: event.outcome
+ value: failure
+
+ - lowercase:
+ field: http.request.method
+ ignore_missing: true
+
+ - set:
+ if: "ctx?.aws?.elb?.trace_id != null"
+ field: tracing.trace.id
+ value: "{{aws.elb.trace_id}}"
+
  - split:
  field: '_tmp.actions_executed'
  target_field: 'aws.elb.action_executed'