[AWS] Add WAF datastream

[legoguy1000]

What does this PR do?

Adds a new datastream to parse WAF logs

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• If I'm introducing a new feature, I have modified the Kibana version constraint in my package's manifest.yml file to point to the latest Elastic stack release (e.g. ^7.13.0).

Author's Checklist

• [ ]

How to test this PR locally

cd integrations/packages/aws elastic-package build && elastic-package stack down && elastic-package stack up -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test -v --data-streams waf 

Related issues

• Relates Filebeat AWS Module - S3 input support for AWS WAF logs beats#28121

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-10-13T09:53:04.890+0000

• Duration: 18 min 40 sec

• Commit: a900db8

Test stats 🧪

Test	Results
Failed	0
Passed	260
Skipped	0
Total	260

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[P1llus]

This is LGTM from my side in terms of how the data is parsed, would want an approval from @kaiyan-sheng especially on the addition to the AWS package, as I know these are made as subpackages etc?

[legoguy1000]

The only thing i don't know about the WAF logs is if they are nested like the other JSON AWS logs

{ "Records": [ {}, {},.... ] } 

[P1llus]

The only thing i don't know about the WAF logs is if they are nested like the other JSON AWS logs

{ "Records": [ {}, {},.... ] } 

From what I can see @legoguy1000, that is more specific to Cloudtrail logs. When WAF logs are written directly to S3 (for example with Kinesis) it does not come in that nested format.

[kaiyan-sheng]

/test

[P1llus]

/test

[P1llus]

Anything else needed for this @kaiyan-sheng ?

[kaiyan-sheng]

@P1llus Looks good to me 👍 Thanks!!