[Auditbeat] Login dataset: Add event category and type

[cwurm]

Adds event.category: authentication and event.type: authentication_success (or authentication_failure).

I also took the opportunity to add another unit test for a successful login.

[elasticmachine]

Pinging @elastic/secops

[webmat]

LGTM

[andrewkroh]

Why was this added? IIUC the data directory is removed in between tests so the whole DB gets deleted.

[cwurm]

That's true, but for some reason that does not cause it to be re-read. Copy pasting one of the test functions causes the second one to fail, every time. I turned on debug logging and it still has the data written in the first function.

I didn't find out exactly why this happens, but I suspect it's because we use a sync.Once here, and the data path will never get re-resolved:

beats/auditbeat/datastore/datastore.go

Lines 35 to 47 in d36eb5a

	// OpenBucket returns a new Bucket that stores data in {path.data}/beat.db.
	// The returned Bucket must be closed when finished to ensure all resources
	// are released.
	func OpenBucket(name string) (Bucket, error) {
	initDatastoreOnce.Do(func() {
	ds = &boltDatastore{
	path: paths.Resolve(paths.Data, "beat.db"),
	mode: 0600,
	}
	})
	return ds.OpenBucket(name)
	}

This only really matters in tests as far as I can see, so I didn't dig deeper into it but just added the DeleteBucket() call.

[andrewkroh]

Oh yeah, that's what it is. OpenBucket uses the singleton instance and the DB path is only ever initialized once. The singleton instance is closed when all the users (metricsets) close their buckets. But when it gets reused again it still will have the original path so our cleanup has no effect.

One option would be to have a package global function that the metricsets use to open a bucket. That fn handle could be swapped for testing purposes. We use this pattern in a few places. For example

var openBucket = datastore.OpenBucket

Then for testing swap in a different func.

openBucket = func(name string) (Bucket, error) {
    return datastore.New(paths.Join(testDir, "beat.db"), 0600).OpenBucket(name)
}

[cwurm]

Yeah, we could do that separately. Merging this for now.