[AWS] Support VPC flow logs with message field

packages/aws/changelog.yml

@@ -1,4 +1,12 @@
 # newer versions go on top
+- version: "1.28.2"
+  changes:
+    - description: Add dot_expander processor to expand all fields with dot into object fields
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4830
+    - description: Support VPC flow log with message field
+      type: bugfix
+      link: https://github.com/elastic/integrations/pull/4830
 - version: "1.28.1"
   changes:
     - description: Adjust kinesis integration to kinesis data stream

packages/aws/data_stream/vpcflow/_dev/test/pipeline/test-with-message-field.log

@@ -0,0 +1 @@
+{\"message\":\"2 428961148399 eni-0e0bf7be352692297 - - - - - - - 1671029698 1671029728 - NODATA\"}

packages/aws/data_stream/vpcflow/_dev/test/pipeline/test-with-message-field.log-expected.json

@@ -0,0 +1,35 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2022-12-14T14:55:28.000Z",
+            "aws": {
+                "vpcflow": {
+                    "account_id": "428961148399",
+                    "interface_id": "eni-0e0bf7be352692297",
+                    "log_status": "NODATA",
+                    "version": "2"
+                }
+            },
+            "cloud": {
+                "account": {
+                    "id": "428961148399"
+                },
+                "provider": "aws"
+            },
+            "ecs": {
+                "version": "8.0.0"
+            },
+            "event": {
+                "category": "network",
+                "end": "2022-12-14T14:55:28.000Z",
+                "kind": "event",
+                "original": "2 428961148399 eni-0e0bf7be352692297 - - - - - - - 1671029698 1671029728 - NODATA",
+                "start": "2022-12-14T14:54:58.000Z",
+                "type": "connection"
+            },
+            "tags": [
+                "preserve_original_event"
+            ]
+        }
+    ]
+}

packages/aws/data_stream/vpcflow/elasticsearch/ingest_pipeline/default.yml

@@ -24,6 +24,10 @@ processors:
       value: network
   - drop:
       if: 'ctx.event?.original.startsWith("version") || ctx.event?.original.startsWith("instance-id")'
+  - dissect:
+      field: event.original
+      pattern: '{\"message\":\"%{event.original}\"}'
+      ignore_failure: true
   - script:
       lang: painless
       if: ctx.event?.original != null
@@ -243,6 +247,8 @@ processors:
       if: 'ctx.source?.ip != null && ctx.destination?.ip != null'
       field: related.ip
       value: ["{{source.ip}}", "{{destination.ip}}"]
+  - dot_expander:
+      field: "*"
   - set:
       field: cloud.provider
       value: aws

packages/aws/manifest.yml

@@ -1,7 +1,7 @@
 format_version: 1.0.0
 name: aws
 title: AWS
-version: 1.28.1
+version: 1.28.2
 license: basic
 description: Collect logs and metrics from Amazon Web Services with Elastic Agent.
 type: integration