Allow - in Apache access log byte count

[cwurm]

Allows a - instead of a number for the byte sent part of the Apache access log, as described in http://httpd.apache.org/docs/current/mod/mod_log_config.html

In contrast, Nginx will always output 0 - so no need to change anything there.

There are a few more pieces in the Grok pattern that are not quite in line with what Apache can produce. The Elasticsearch grok processor inherited a list of patterns from Logstash. One of them being COMBINEDAPACHELOG, we might want to mirror that in Filebeat. I guess that might be a more intrusive change, while this PR as-is can do no harm and should be fully backward compatible.

[cwurm]

This addresses #3833.

[exekias]

jenkins, retest it please

[exekias]

Could you please add CHANGELOG entry?

[cwurm]

@exekias I guess, though what should it look like? Which version(s)? Most recent release is 5.3.0, and the CHANGELOG here on master doesn't even cover that.

[exekias]

Just add it in HEAD section, we will manage that in the backport

[cwurm]

@exekias done

[tsg]

Thanks for the fix @cwurm. I didn't use the COMBINEDAPACHELOG because I want control over the names of the resulting fields. Perhaps another option would have been to do renames afterwards, not sure.

[cwurm]

@tsg We could take the grok pattern behind COMBINEDAPACHELOG and replace the variable names. Except for some for which we don't have a field Beats - but that's probably fine, as almost nobody uses ident anyway for example.