Add fields from ECS logging spec to log support in v2 intake API

[lahsivjar]

Extend the log support in v2 intake API to handle fields in ECS logging spec.

[felixbarny]

One complication is that the properties might be specified as dotted keys, such as "log.level".

Example ecs log line:

{"@timestamp":"2019-08-06T12:09:12.375Z", "log.level": "INFO", "message":"Tomcat started on port(s): 8080 (http) with context path ''", "service.name":"spring-petclinic","process.thread.name":"restartedMain","log.logger":"org.springframework.boot.web.embedded.tomcat.TomcatWebServer"}

If we specify in the json schema that log is an object, we might ignore the "log.level" field.

So we'll need to expand dots before passing onto the JSON decoding and validation.

[simitt]

@lahsivjar please let the apm-agents developers know once this is merged.

[axw]

Tested with BC2. Works well overall, but I found a few issues:

• Intake accepts dataset, should be event.dataset according to the ECS logging spec: https://github.com/elastic/ecs-logging/blob/main/spec/spec.json#L97
• The error.grouping_key is being added (by the error grouping key model processor) to application logs with error.* fields. I think this should only be done for error events.
• The app_logs data stream is missing field definitions for: error.stack_trace, event.dataset, log.logger, log.origin.file.line, log.origin.file.name, log.origin.function, and process.thread.name

[axw]

Opened https://github.com/elastic/apm-server/issues/9666