[FEATURE] Webserver access logs analytics

Is your feature request related to a problem?
There is a Apache log detector that looks for specific Apache faults. Web server access logs in general can also be used to detect attacks, i.e. by scanning the query string, the number of non-200's generated by a single client, etc. Suricata does this in part for unencrypted traffic.

Almost every web server gives you the same basic details of a web request. This should work for Apache/Nginx/IIS/F5 load balancer logs/etc.

What solution would you like?
Implement detection rules for web server access logs

What alternatives have you considered?
Suricata detection (but it isn't a catch all solution because of TLS)

Do you have any additional context?
Add any other context or screenshots about the feature request here.

Start by reviewing the existing Apache log detector and its detection rules, then compare the common request fields described in the issue across Apache, Nginx, IIS, and F5 logs. The work is done when agreed rules detect the specified access-log attack patterns across the supported formats, with validation criteria established for the rules.