[Filebeat][Gsuite] Adds Groups audit Fileset

[marc-gr]

What does this PR do?

• Adds a new fileset that fetches the groups audits for GSuite module

Why is it important?

Enhances GSuite module with more meaningful filesets.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Relates to

Depends on #19702

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #19725 updated]

• Start Time: 2020-07-14T23:48:46.264+0000

• Duration: 55 min 20 sec

Test stats 🧪

Test	Results
Failed	0
Passed	4252
Skipped	679
Total	4931

Steps errors

Expand to view the steps failures

• Name: Report to Codecov

  • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

  • Duration: 2 min 22 sec

  • Start Time: 2020-07-15T00:10:43.856+0000

  • log

[andrewkroh]

The one LGTM too.

General question that may affect others in this module. I've looked at this and the login fileset, was there any previous discussion regarding setting source.* instead of client.*? ECS advises to always set source and to set client when it adds context (docs). Having fields like source.ip populated consistently makes it easier to pivot between different source IMO.

[marc-gr]

The one LGTM too.

General question that may affect others in this module. I've looked at this and the login fileset, was there any previous discussion regarding setting source.* instead of client.*? ECS advises to always set source and to set client when it adds context (docs). Having fields like source.ip populated consistently makes it easier to pivot between different source IMO.

Makes sense, since it is a change to the common part to all filesets, I will open it as a new PR though 👍