Add asset sub-fields

[miwent]

Please describe what you are requesting
Add an asset sub-field type with fields such as:
..._asset_ip
..._asset_mac
..._asset_owner
..._asset_location
..._asset_location

Look at existing schema fields and consider other sources of data.

Describe what change you are proposing
Adding asset information will expand our schema to further integrate with the asset functionality being built into Graylog Security. Normalizing these fields can be part of the processing sequence to help ease the adoption of asset data integration.

Describe the log source
Many.

Attach any sample logs or examples for details
For example, Winlogbeat can include host information such as:

  "winlogbeat_host_architecture": "x86_64",
  "winlogbeat_host_hostname": "desktop-fnv6te0",
  "winlogbeat_host_id": "23fd01a8-11d4-44cd-8be9-774d7e1b68a5",
  "winlogbeat_host_ip": "[\"fe80::a5b6:c5c5:c4d2:74c5\",\"172.16.14.33\",\"fe80::fe1a:1ae7:f79c:6bad\",\"169.254.131.73\",\"fe80::e336:e318:634:670b\",\"169.254.40.184\",\"fe80::c115:dfaf:1982:7b84\",\"17.16.14.1\",\"fe80::7010:25d:f784:9f71\",\"172.16.15.20\"]",
  "winlogbeat_host_mac": "[\"00-50-56-C0-00-01\",\"00-50-56-C0-00-08\",\"00-50-56-C0-00-0B\",\"0A-00-27-00-00-07\",\"F8-B1-56-BA-D6-BD\"]",

This information should does not necessarily fit in context with fields like source_ip, destination_ip, etc. since that information is contextual to an actual network connection between a source and a host. Adding it as additional ..._asset_... sub-field(s) can provide normalized data to a potential asset pack which can supply this data to the asset functionality in Graylog Security.