allow custom tags to be specified at the point of log file ingestion (ie., filebeat)

[mmguero]

At the point where logs are collected (by filebeat) and forwarded along (to logstash), we're already using adding tags at the source.

We'd like to add a custom setting (environment variable) for adding additional user-defined tags. This would allow for an easy way to do custom user-defined groupings and labels of traffic.

[mmguero]

On hedgehog for configuration:

And the tags being applied to zeek, suricata, and arkime logs:

I think the only thing I have left to do is some sanitizing of the inputs for the tags (figure out what characters can/can't be allowed) and it's done.

[mmguero]

Need to handle this at the Malcolm level as well (not just hedgehog)