[Azure App Service] Missing azure.subscription_id

[ckauf]

None of the Azure App Service Datasets contains the azure.subscription_id field. This can be validated by checking the expected JSONs, e.g. here:
https://github.com/elastic/integrations/blob/main/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json

For comparison a Azure Activity Logs example
https://github.com/elastic/integrations/blob/main/packages/azure/data_stream/activitylogs/_dev/test/pipeline/test-activitylogs-edgecases.log-expected.json

[ckauf]

Upon closer inspection it looks like the included azure shared pipeline is not executed. However that would also not solve the problem because the App Service integration parses the fields to azure.resource.id while the shared pipeline expects it to be in azure.resource_id.

[botelastic]

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

[giorgi-imerlishvili-elastic]

I made changes in following PR: #15487
I included azure shared pipelines with minor changes
I want notice that in existing test logs showing subscription_id is not expected anyway https://github.com/elastic/integrations/blob/main/packages/azure_app_service/data_stream/app_service_logs/_dev/test/pipeline/test-appserviceapplogs-raw.log-expected.json
because in existing test case we have resource ids:
/SUBSCRIPTIONS/0E072EC1-C22F-44L8-ADDE-DA36ED609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86
and
/SUBSCRIPTIONS/0E0733C1-C22F-4408-ADDE-DA35XD609CCD/RESOURCEGROUPS/LUCIAN.DEACONESCU_RG_6914/PROVIDERS/MICROSOFT.WEB/SITES/MANGO-TREE-3004D00656084194B08980B8DB637B86
if you look carefully those SUBSCRIPTIONS: 0E072EC1-C22F-44L8-ADDE-DA36ED609CCD and 0E0733C1-C22F-4408-ADDE-DA35XD609CCD
has no valid GUIDs (it contains non valid hexes like: 0xL8, 0xXD) for that reason grok processor fails to parse it as we use guid valid pattern for parsing GUIDs
I can change that pattern in order to make it able parse even non valid GUIDs
But before I make changes we should decide:

• fix test cases with valid guids and expect we always get valid guid as subscription id
• change guid pattern for grok processor in order to match non valid hexes