Filebeat auditd: Fix Top Exec Commands dashboard visualization (#27638)…

… (#27646)

This visualization was expecting an uppercase EXECVE value in
event.action while the ingest pipeline was lowercasing this value.

(cherry picked from commit 9b574ef)

CHANGELOG.next.asciidoc

@@ -174,6 +174,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix s3 input when there is a blank line in the log file. {pull}25357[25357]
 - Fixes the Snyk module to work with the new API changes. {pull}27358[27358]
 - Fixes a bug in `http_endpoint` that caused numbers encoded as strings. {issue}27382[27382] {pull}27480[27480]
+- Auditd: Fix Top Exec Commands dashboard visualization. {pull}27638[27638]
 
 *Heartbeat*
 

filebeat/module/auditd/_meta/kibana/7/dashboard/Filebeat-auditd.json

@@ -62,7 +62,7 @@
                         "index": "filebeat-*", 
                         "query": {
                             "language": "kuery",
-                                "query": "event.action:EXECVE"
+                                "query": "event.action:execve"
                             }
                     }
                 },