Add Cloudflare package

[legoguy1000]

What does this PR do?

Add Cloudflare integration

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.

How to test this PR locally

cd integrations/packages/cloudflare
elastic-package build && elastic-package stack up -d --services=elasticsearch && $(elastic-package stack shellinit) && elastic-package test pipeline

Related issues

• Relates Add module to fetch Cloudflare logs beats#2666
• Closes Cloudflare #1305

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-08-10T07:39:08.343+0000

• Duration: 12 min 58 sec

• Commit: 002ccdd

Test stats 🧪

Test	Results
Failed	0
Passed	91
Skipped	0
Total	91

Trends 🧪

[P1llus]

run tests

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[marc-gr]

Thanks for the contribution :D!

Aside from the couple comments, would be nice to add in some of the latest improvements/practices. If you prefer I can push the changes myself or I can help you in doing them:

1- For the ecs fields file, now you can reference directly the ECS definitions from the original repository, take a look at https://github.com/elastic/integrations/pull/971/files#diff-ab0b8ba7ee65eeaec37ad049da3278b9e3f27eafc297ef39b4d97d5557f1e3d7R1 and https://github.com/elastic/integrations/pull/971/files#diff-e25525aa40a63de53545aad0489afe6dd123f5840076dfae30b3f0ad63da1edbR1 for an example, this saves a lot of boilerplate and makes for consistent descriptions across packages.
2- Instead of the _conf field to decide to keep or not the event.original, you can take https://github.com/elastic/integrations/pull/971/files#diff-3e0dc30780e24af54910c65b1217d914992e35cf87045ed76728285b3851ec9bR1 as an example of how we standardised it across all packages, in addition for a custom processors field. You might also want to check how the option is handled in the config and in the pipeline

Also if you can add a couple screenshots of the dashboards that would be great.

Thanks!

[legoguy1000]

@marc-gr I think i resolved all the issues you brought up in the first round :).

[legoguy1000]

@marc-gr I also found an issue that the geo field groupings are not included as subbordinate fields un the source, destination, client, server, observer as shown here https://github.com/elastic/ecs/blob/v1.10.0/code/go/ecs/destination.go

[marc-gr]

@marc-gr I also found an issue that the geo field groupings are not included as subbordinate fields un the source, destination, client, server, observer as shown here https://github.com/elastic/ecs/blob/v1.10.0/code/go/ecs/destination.go

They should be safe to add in those, according to https://www.elastic.co/guide/en/ecs/current/ecs-geo.html, note that AS
is not allowed in observer though https://www.elastic.co/guide/en/ecs/current/ecs-as.html

[marc-gr]

Looking good! after the last comments I think it should be good to go 👍

[marc-gr]

/test