zscaler_zia: Use source.nat.ip as an alternate for geo IPs in firewall and web logs.

[kcreddy]

Proposed commit message

Users may have private IPs inside source.ip which prevents geo fields from getting populated.
This PR:

• Uses source.nat.ip as an alternate for populating geo fields if not already populated by source.ip.
• Removes processor explicitly populating geo.country_name as it is added by geoip processor.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

cd packages/zscaler_zia && elastic-package build && elastic-package stack up --version=8.13.0 -d -v && eval "$(elastic-package stack shellinit)" && elastic-package test pipeline --generate -v

--- Test results for package: zscaler_zia - START --- ╭─────────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────┬────────┬──────────────╮ │ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME │ RESULT │ TIME ELAPSED │ ├─────────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────┼────────┼──────────────┤ │ zscaler_zia │ firewall │ pipeline │ (ingest pipeline warnings test-firewall-http-endpoint.log) │ PASS │ 348.205541ms │ │ zscaler_zia │ firewall │ pipeline │ (ingest pipeline warnings test-firewall.log) │ PASS │ 333.986667ms │ │ zscaler_zia │ firewall │ pipeline │ (ingest pipeline warnings test-unicode.json) │ PASS │ 372.179208ms │ │ zscaler_zia │ firewall │ pipeline │ test-firewall-http-endpoint.log │ PASS │ 94.69425ms │ │ zscaler_zia │ firewall │ pipeline │ test-firewall.log │ PASS │ 88.065417ms │ │ zscaler_zia │ firewall │ pipeline │ test-unicode.json │ PASS │ 65.712959ms │ ╰─────────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────┴────────┴──────────────╯ --- Test results for package: zscaler_zia - END --- Done 

Related issues

Screenshots

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: e605711e6291b4a2a31a0b4734dcb5adaf886427

cc @kcreddy

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
53.3% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package zscaler_zia - 3.6.3 containing this change is available at https://epr.elastic.co/package/zscaler_zia/3.6.3/