Add ECS field validation enrichment for event.type, event.category, e…

[mangit955]

Description

This PR adds ECS (Elastic Common Schema) field validation enrichment for the following fields:

• event.type
• event.category
• event.kind
• event.outcome

The enrichment ensures that only permitted values according to the ECS specification are allowed. Any invalid values are tagged and removed from the event, helping maintain ECS compliance across Logstash pipelines.

Changes Included

• Added translate filters for each ECS field with allowed values.
• Fallback tagging for invalid values.
• stdout output for debugging and verification.

Testing

• Tested locally using test_event.json.
• Logstash pipeline correctly tags invalid ECS field values.

Benefits

• Prevents invalid ECS field values from entering Elasticsearch.
• Standardizes event data across OpenSIEM.

Related Issues

• None

Todos

• Review and merge.
• Optional: add more test events for edge cases.

[mangit955]

Adds ECS field validation to ensure only permitted values for event.type, event.category, event.kind, and event.outcome. Invalid values are automatically tagged and removed, helping maintain ECS compliance across Logstash pipelines. Tested locally with sample events.