[Suricata] Updated mappings to leverage import_mappings functionality

[vinit-chauhan]

Enhancement

What does this PR do?

This PR here, Dumps the old way of defining ECS field mappings and uses import_mappings functionality.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

• Closes [Suricata] Missing ECS Field Mappings #7274

Screenshots

[elasticmachine]

❕ Build Aborted

The PR is not allowed to run in the CI yet

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-09-01T19:55:41.681+0000

• Duration: 4 min 33 sec

Steps errors

Expand to view the steps failures

Load a resource file from a library

• Took 0 min 0 sec . View more details here
• Description: approval-list/elastic/integrations.yml

Error signal

• Took 0 min 0 sec . View more details here
• Description: githubApiCall: The REST API call https://api.github.com/orgs/elastic/members/vinit-chauhan return the message : java.lang.Exception: httpRequest: Failure connecting to the service https://api.github.com/orgs/elastic/members/vinit-chauhan : httpRequest: Failure connecting to the service https://api.github.com/orgs/elastic/members/vinit-chauhan : Code: 404Error: {"message":"User does not exist or is not a member of the organization","documentation_url":"https://docs.github.com/rest/orgs/members#check-organization-membership-for-a-user"}

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[bhapas]

May be 2.13.0 as this is an enhancement

[bhapas]

Where can the user refer to the other mappings that are imported. Isn't there a way to show imported mappings in the docs too , Probably users are used to it?

[vinit-chauhan]

Hey @bhapas - Added those files back again. Would you please re-review it?

[andrewkroh]

Until we have a solution for populating the index.query.default_field and the readme docs, perhaps we should leave the static ECS mappings in-place? import_mappings: true will function to help users that have added additional ECS fields through custom pipelines or other means.

[vinit-chauhan]

Hey @andrewkroh - 👋🏻

So, the reason I've removed those static files is because, what if we have conflicts between them? And AFAIK, there were scenarios in past where we had conflicts between them.I wonder what would happen if there's a conflict between these static files and ECS imported from import_mappings.
I'll have to check whether it would consider the imported mappings or the static mapping?!

[vinit-chauhan]

It seems like the issue has been taken care of in #7657. Hence Closing the PR.