Improving regex oring

[arblade]

1. I improved the regex oring part, making it cleaner, with clear methods and a readable template.
2. I added the ability to handle nested fields like Event.EventData.fieldX. Splunk is not allowing dots in regex groups, so I added a field cleaning part. In the case of an Event.EventData.fieldA, we are now getting fieldAMatch instead of Event.EventData.fieldAMatch (which was previously triggering a splunk error in the regex group of the template.

[arblade]

Some complements

• adding a simple matching for cidr as splunk supports fieldA="10.0.0.0/8", see this splunk ref. It supports oring.
• adding boolean operators as some rules may use boolean and not their string version (like field: true instead of field: 'true' : see this rule which raises an error on the current version).
• adding fieldref integration (without ORing, maybe later ... )

May fix following issues :

• Enhancement: Implement "|re" modifier for fields #44
• ORing modifier CIDR error #35
• Splunk backend allegedly doesn't support or conditions in regex, but fails to detect them (and for some reason creates a newline before | regex) #29

[thomaspatzke]

Great PR, thanks a lot!