Update beats framework and adapt to new processor handling. (#1982)

* Adapt beat root cmd to processor changes.
* adapt to common.Field -> mapping.Field move
* Update beats framework to 98e0dbe

NOTICE.txt

@@ -245,13 +245,37 @@ SOFTWARE.
 --------------------------------------------------------------------
 Dependency: github.com/elastic/beats
 Version: master
-Revision: 7c338ce879cf27958c926d70b89ec9385a09e288
+Revision: 98e0dbe35d1dab6d9a7c469096dcac0fe700187f
 License type (autodetected): Apache-2.0
 ./vendor/github.com/elastic/beats/LICENSE.txt:
 --------------------------------------------------------------------
 Apache License 2.0
 
 
+--------------------------------------------------------------------
+Dependency: github.com/elastic/ecs
+Revision: b9f735dd33b0bbb95dbca4229397c9b7f81f8f53
+License type (autodetected): Apache-2.0
+./vendor/github.com/elastic/ecs/LICENSE.txt:
+--------------------------------------------------------------------
+Apache License 2.0
+
+-------NOTICE.txt-----
+Elastic Common Schema
+Copyright 2018 Elasticsearch B.V.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
 --------------------------------------------------------------------
 Dependency: github.com/elastic/go-lumber
 Revision: 616041e345fc33c97bc0eb0fa6b388aa07bca3e1

_beats/dev-tools/ecs-migration.yml

@@ -486,11 +486,6 @@
   alias: true
   beat: filebeat
 
-- from: system.auth.ssh.event
-  to: event.action
-  alias: true
-  beat: filebeat
-
 - from: system.auth.program
   to: process.name
   alias: true

_beats/libbeat/_meta/fields.common.yml

@@ -4,6 +4,10 @@
   description: >
     Contains common beat fields available in all event types.
   fields:
+    - name: agent.hostname
+      type: keyword
+      description: Hostname of the agent.
+
     - name: beat.timezone
       type: alias
       path: event.timezone