[Keycloak] Add support for impersonator, impersonator_realm and session.id fields

[moxarth-rathod]

Proposed commit message

keyclock: add support for impersonator, impersonator_realm and session.id fields

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Clone integrations repo.
• Install elastic package locally.
• Start elastic stack using elastic-package.
• Move to integrations/packages/keyclock directory.
• Run the following command to run tests.

elastic-package test -v

Related issues

• Closes [Keycloak] Parse impersonator_realm and impersonator fields #16533

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package keycloak 👍(0) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
log	2506.27	2008.03	-498.24 (-19.88%)	💔

To see the full report comment with /test benchmark fullreport

[chemamartinez]

LGTM, please update PR link in changelog before merging it.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 729ba50

History

• 💚 Build #35853 succeeded d202bba

cc @moxarth-rathod

[elastic-vault-github-plugin-prod]

Package keycloak - 1.31.0 containing this change is available at https://epr.elastic.co/package/keycloak/1.31.0/