Add support for S3 bucket upload

[dnovitski]

Hi @pierredavidbelanger,

We noticed that using CloudWatch logs is rather expensive and sought a way to reduce the cost.
One way we found is to use AWS S3 instead.

So the idea is apps will upload their logs to an AWS S3 bucket (after each flush time), and this S3 bucket will have event notification enabled to send ObjectCreated events to an AWS SQS queue when new log files are uploaded.

A separate Filebeat service will watch the SQS queue and pick up these log files for shipping to ElasticSearch.

We expect to reduce our logging costs 10x by using this strategy, and still retaining all the same functionality we had before.

This PR adds support in the AWSLogs appender for uploading to S3 bucket.
All the concepts from CloudWatch (log groups, log streams, etc) are ported over to the S3 way so users can easily switch between the two if needed.

As example, we use the following logback and Filebeat configuration:

Logback.xml

<?xml version="1.0" encoding="UTF-8"?>
<configuration debug="false">
    <appender name="awslogs" class="ca.pjer.logback.AwsLogsAppender">
        <verbose>false</verbose>

        <encoder class="net.logstash.logback.encoder.LogstashEncoder">
            <includeCallerData>true</includeCallerData>
        </encoder>
        <logGroupName>${MY_LOGGROUP}</logGroupName>
        <logStreamNamePattern>%{uuid}</logStreamNamePattern>
        <logRegion>${MY_REGION}</logRegion>
        <maxBatchLogEvents>10000</maxBatchLogEvents>
        <maxFlushTimeMillis>1000</maxFlushTimeMillis>
        <maxBlockTimeMillis>0</maxBlockTimeMillis>
        <retentionTimeDays>1</retentionTimeDays>

        <bucketName>${MY_BUCKET}</bucketName>
        <bucketPath>logs/log_stream_cluster=${MY_CLUSTER}/log_group=%{log_group}/date=%{date}/log_stream_container=${MY_APP}/log_stream=%{log_stream}/%{counter}.log</bucketPath>
        <logOutputType>s3</logOutputType>
        <verbose>true</verbose>
    </appender>

    <root level="INFO">
        <appender-ref ref="awslogs" />
    </root>
</configuration>

Filebeat:

filebeat.inputs:
- type: aws-s3
  queue_url: "${AWS_S3_QUEUE_URL}"
  content_type: application/json
  expand_event_list_from_field: Records

output.elasticsearch:
  hosts: '${ES_HOSTS}'
  allow_older_versions: true
  ssl.verification_mode: "none"
  username: "${FILEBEAT_USER}"
  password: "${FILEBEAT_PASS}"
  indices:
    - index: "myindex-%{+yyy.MM.dd}"
  compression_level: 5
  worker: 1
  max_retries: 3
  bulk_max_size: 500
  backoff.init: 1s
  backoff.max: 30s
  timeout: 10s

setup.template.enabled: false
setup.ilm.enabled: false

processors:
- decode_json_fields:
    when.regexp.message: '^{'
    fields: ["message"]
    target: ""
    overwrite_keys: true
- dissect:
    tokenizer: "logs/log_stream_cluster=%{log_stream_cluster}/log_group=%{log_group}/date=%{log_date}/log_stream_container=%{log_stream_container}/log_stream=%{log_stream_id}/%{log_filename_id}"
    field: "aws.s3.object.key"
    target_prefix: ""
    ignore_failure: true
    overwrite_keys: true
- drop_fields:
    fields: ["message_type", "agent", "ecs.version", "host.name", "owner", "subscription_filters", "aws.s3", "cloud", "input.type", "log.file.path", "log.offset", "log_filename_id", "log_date"]
    ignore_missing: true

logging.level: "${LOGGING_LEVEL}"