[Auditbeat] Add ECS categories for system-host module

[andrewstucki]

What does this PR do?

Checklist

• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

• Closes [Auditbeat] Update Auditbeat system module host dataset to ECS 1.4 #17521

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[leehinman]

ECS categorization looks great.

Looks like we could populate the ECS host fields. Should we add that?

[andrewstucki]

@leehinman so, the host fields (and more) are already actually populated in this function:

beats/x-pack/auditbeat/module/system/host/host.go

Lines 118 to 125 in a601961

	func (host *Host) toMapStr() common.MapStr {
	mapstr := common.MapStr{
	// https://github.com/elastic/ecs#-host-fields
	"uptime": host.Uptime,
	"boottime": host.Info.BootTime,
	"timezone.name": host.Info.Timezone,
	"timezone.offset.sec": host.Info.TimezoneOffsetSec,
	"hostname": host.Info.Hostname,

We currently populate:

host.architecture
host.hostname
host.id
host.ip
host.mac
host.uptime
host.os.platform
host.os.name
host.os.family
host.os.version
host.os.kernel

Just for kicks, I added host.name too and set it to the same value as host.hostname as specified in the ECS reference docs:

Name of the host.

It can contain what hostname returns on Unix systems...

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request [Auditbeat] Add ECS categories for system-host module #18031 updated]

• Start Time: 2020-05-05T13:28:48.620+0000

• Duration: 38 min 3 sec (2283003)

• Commit: aa99b05

Test stats 🧪

Test	Results
Failed	0
Passed	189
Skipped	17
Total	206

[leehinman]

LGTM