The updated spec expects ecs.version to be dotted, not nested, to match log.level.
ecs.version
log.level