Add support for saddr_fam filter to AuditBeat

[chrisanag1985]

Hi!!! I tried to filter out some traffic and get only AF_INET and AF_INET6 audit logs using these rules:

-a always,exit -F arch=b64 -S connect,accept,listen,bind  -F a2=16 -F saddr_fam=2 -F success=1 -F key=network-v4
-a always,exit -F arch=b64 -S connect,accept,listen,bind  -F a2=24 -F saddr_fam=10 -F success=1 -F key=network-v6

but I get this error

[root@PC rules.d]# auditbeat test config
Exiting: 1 error: failed to unpack the auditd config: 1 error: failed loading rules: 2 errors: at /etc/auditbeat/audit.rules.d/audit-rules.conf:24: failed to interpret rule '-a always,exit -F arch=b64 -S connect,accept,listen,bind  -F a2=16 -F saddr_fam=2 -F success=1 -F key=network-v4': failed to add filter '{2 saddr_fam = 2}': invalid field 'saddr_fam' on left; at /etc/auditbeat/audit.rules.d/audit-rules.conf:25: failed to interpret rule '-a always,exit -F arch=b64 -S connect,accept,listen,bind  -F a2=24 -F saddr_fam=10 -F success=1 -F key=network-v6': failed to add filter '{2 saddr_fam = 10}': invalid field 'saddr_fam' on left accessing 'auditbeat.modules.0' (source:'/etc/auditbeat/auditbeat.yml')

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

This issue doesn't have a Team:<team> label.

[andrewkroh]

I created an issue in the upstream library. elastic/go-libaudit#144