[Cloudflare] Add _id field to LogPull data_stream

[legoguy1000]

What does this PR do?

adds teh fingerprint processor to deduplicate events for Cloudflare LogPull when using multiple agents.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-04-26T21:57:38.651+0000

• Duration: 15 min 40 sec

Test stats 🧪

Test	Results
Failed	0
Passed	96
Skipped	0
Total	96

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[efd6]

/test

[efd6]

Please run elastic-package build.

[legoguy1000]

Please run elastic-package build.

I did multiple times and it hasn't made any changes. I normally use the latest Elastic Package build from main branch and even changed to the latest tag, v0.47.0 and still no changes from whats already in the branch.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

I did multiple times and it hasn't made any changes. I normally use the latest Elastic Package build from main branch and even changed to the latest tag, v0.47.0 and still no changes from whats already in the branch.

Double check the version you have installed with elastic-package version. From this branch it had changes for me. I used:

gh pr checkout 3187
go install github.com/elastic/elastic-package
cd packages/cloudflare
elastic-package build

[andrewkroh]

/test

[legoguy1000]

@andrewkroh Ya installing elastic package from the go install command instead of building from source appeared to do it.

[andrewkroh]

/test

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (2/2)	💚
Files	100.0% (3/3)	💚 2.918
Classes	100.0% (3/3)	💚 2.918
Methods	100.0% (36/36)	💚 12.106
Lines	95.17% (670/704)	👍 6.492
Conditionals	100.0% (0/0)	💚

[CyberTaoFlow]

How exactly does fingerprint de-duplicate events when using a data-stream? My experience has historically (before data-streams) been that the fingerprint becomes the document id which you then either upsert or update any existing document with that ID.

However with data-streams that is not going to work as the actions are limited to create when targeting the data-stream alias right?

From the elasticsearch datastream documentation...

If needed, you can update or delete documents by submitting requests directly to the document’s backing index.