[Packetbeat] Add support for ignoring interfaces

[gaby]

Describe the enhancement:
Currently when setting the packetbeat sniffer the interface field is either an interface name or any for all interfaces. If you have N number of interfaces your only option is to use any.

• Add support for filtering interfaces you don't want to sniff on.

Describe a specific use case for the enhancement or feature:

The enhancement would be to add support for specifying a list of interfaces that should be ignore by the sniffer. This would allow packetbeat to focus on interfaces the user cares about.

packetbeat.interfaces.ignore: [lo, eth0, veth, docker0]

Current solution

Currently the only way to accomplish this is by adding processors and drop_events, at this point the packetbeat process has sniffed those packets only to be dropped this takes cycles from actual interfaces the user cares about.

The docs say the events have the interface.name field, but I don't have that ECS for some reason. Not sure if it's related to my output being logstash instead of elasticsearch.

[elasticmachine]

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)