Filebeat module sophos, add null safety check and support for an additional timestamp field.

[philippkahr]

What does this PR do?

Sophos in Version 18.5 sends a field called timestamp instead of the old date and time fields. Since the pipeline does not perform any null safety checks on the set command, the pipeline fails.

Additionally, sometimes sent_pkts is not populated and a trim processor is called without ignore_missing resulting in a failure.

Why is it important?

Better pipeline error handling.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

Ingest simulate for the set processor

```json POST _ingest/pipeline/_simulate { "pipeline": { "processors": [ { "set": { "field": "_temp_.time", "value": "{{sophos.xg.date}} {{sophos.xg.time}}", "if": "ctx?.sophos?.xg?.date != null && ctx?.sophos?.xg?.time != null" } }, { "set": { "field": "_temp_.time", "value": "{{sophos.xg.timestamp}}", "if": "ctx?.sophos?.xg?.timestamp != null" } } ] }, "docs": [ { "_source": { "sophos": { "xg": { "date": "2021-08-12", "time": "10:00" } } } }, { "_source": { "sophos": { "xg": { "timestamp": "2021-08-12T10:00Z" } } } }, { "_source": { "sophos": { "xg": { "date": "2021-08-12", "time": "10:00", "timestamp": "2021-08-12T10:00Z" } } } }] } ```

Related issues

• Closes Filebeat module sophos issues with timestamp and sent_pkts #27833

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-09-15T11:53:05.207+0000

• Duration: 93 min 36 sec

• Commit: a97bda8

Test stats 🧪

Test	Results
Failed	0
Passed	8259
Skipped	1201
Total	9460

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	8259
Skipped	1201
Total	9460

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b fix-sophos-module-date-parsing upstream/fix-sophos-module-date-parsing
git merge upstream/master
git push upstream fix-sophos-module-date-parsing

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)