Filebeat Infoblox NIOS module fails to capture client IP field

[adriansr]

For confirmed bugs, please report:

• Version: 7.13.4
• Operating System: n/a
• Discuss Forum URL: n/a
• Steps to Reproduce:

For this original event:

<30>Aug 5 15:15:13 134.184.123.2 named[15183]: queries: client @0x7fd930dbf1f0 10.0.0.25#50045 (example.net): query: example.net IN A + (93.184.216.34)

The raw saddr field captured extra information:

 "rsa.raw.saddr": [
      "@0x7fd930dbf1f0 10.0.0.25"
    ],

This is an RSA2ELK experimental module, which means some of the original RSA patterns should be adjusted to account for this extra field before saddr.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[jamiehynds]

Closing as this will be addressed in our new Infoblox integration: elastic/integrations#3129