[Azure] Fix azure.activitylogs.identity with a a concrete value

[kaiyan-sheng]

What does this PR do?

This PR fixed azure.activitylogs.identity field with a concrete value and tested it with a new format sample activity log.
Error log without this fix:

(status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [azure.activitylogs.identity] tried to parse field [identity] as object, but found a concrete value"}, dropping event!

Also with the new format, this PR added azure.activitylogs.identity_name, azure.activitylogs.tenant_id, azure.activitylogs.level and azure.activitylogs.operation_version fields.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Related issues

• Relates Event Hub: mapper_parsing_exception in activitylogs and signinlogs beats#30886

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-04-06T16:24:38.030+0000

• Duration: 11 min 28 sec

Test stats 🧪

Test	Results
Failed	0
Passed	86
Skipped	0
Total	86

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[aspacca]

if I got it right we where receiving both azure.activitylogs.identity.authorization = {...} and azure.activitylogs.identity = "abc", is this correct?

we now rename azure.activitylogs.identity = "abc" to azure.activitylogs.identity_name = "abc", do we?

[kaiyan-sheng]

yes, that's right. azure.activitylogs.identity as a keyword is new added by azure seems like instead of an object.