[Packetbeat] Support converting text encodings to UTF-8 about beats

[elasticmachine]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

[nfritts]

@andrewkroh Do you know if there are existing pipelines that do something similar? It seems like the challenging part of this is that not call sequences in other encodings can always be converted to utf-8. ideally the failure mode would be consistent across other pipelines and similar

[andrewkroh]

Do you know if there are existing pipelines that do something similar?

I couldn't find any pipelines (as in Elasticsearch ingest node pipelines) that could accomplish this. Nor could I see any Painless features that could do this.

So I think it would need to be done on the Packetbeat. Filebeat is using https://pkg.go.dev/golang.org/x/text/encoding#Decoder for similar work. As for the failure modes, I think it would be consistent with the existing packetbeat HTTP parser to annotate the event with an error.message about the decoding failure.