Non-IP address content in `sourceIPAddress` field is not properly handled

[kailash-everlaw]

Logstash information:

• Logstash version: 7.17.24
• Logstash installation source: apt
• How logstash is being run: as a systemd service
• How the plugin was installed: bin/logstash-plugin install logstash-codec-cloudtrail

JVM (e.g. java -version):

N/A - this is caused by a bug in the Ruby code

OS version (uname -a if on a Unix-like system):

N/A - this is caused by a bug in the Ruby code

Description of the problem including expected versus actual behavior:
CloudTrail's sourceIPAddress field can contain both IP addresses and DNS names [1]. In #22 this plugin was changed to put non-IP address content from the sourceIPAddress field in the sourceHost field instead. However, that functionality does not work properly and non-IP address content stays in the sourceIPAddress field.

This is due to two separate issues:

1. In

   logstash-codec-cloudtrail/lib/logstash/codecs/cloudtrail.rb

   Line 41 in 4486ce2

   source_ip_address = event["sourceIpAddress"]

   and

   logstash-codec-cloudtrail/lib/logstash/codecs/cloudtrail.rb

   Line 43 in 4486ce2

   event["sourceHost"] = event.delete("sourceIpAddress")

   there is a typo - sourceIpAddress should actually be sourceIPAddress. This causes source_ip_address to always be nil which means

   logstash-codec-cloudtrail/lib/logstash/codecs/cloudtrail.rb

   Line 42 in 4486ce2

   if source_ip_address && source_ip_address !~ Resolv::IPv4::Regex && source_ip_address !~ Resolv::IPv6::Regex

   always evaluates to false and the field is never renamed
2. The file is missing a require 'resolv' statement, so if source_ip_address is ever not nil the Resolv references will throw an error

[1] https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html

Steps to reproduce:
I can try to put together an anonymized set of configuration files if necessary, but I'm hoping that won't be necessary since the issue is relatively straightforward. It should be fairly easy to reproduce if you have access to an AWS account - you just need to configure logstash to read the CloudTrail logs using this plugin and examine the output.

Provide logs (if relevant):
AFAICT there are no logs related to these bugs, but if you fix the typos and don't add the require statement you'll see the following error in the logs:

Failed to read file, processing skipped {:exception=>NameError, :message=>"uninitialized constant LogStash::Codecs::CloudTrail::Resolv", :filename=>"$INPUT_FILE"}