Script to generate breaking field changes list (#10405)

This script generates a list with breaking field changes based on ecs-migration.yml. For each Beat it can generate the list containing libbeat fields + the fields from the Beat itself. For now it's included in the Breaking changes for 7.0 and one table exists for each Beat. Few questions:

* Should we have this in libbeat or as part of each Beat breaking changes?
* How will this conflict with the breaking changes listed in auditbeat?
* Should we add more details on how the fields changed like in some cases there is a scaling factor or the content changed. Most of this info is already in ecs-migration.yml
* Who do we do about the changes where we changed the type. It's not yet in the ecs-migration.yml files.

An example output looks as following:

```
In version 7.0 the following fields were renamed.

.Renamed Fields in 7.0
[frame="topbot",options="header"]
|======================
|Old Field|New Field
|`apache2.access.body_sent.bytes`            |`http.response.body.bytes`
|`beat.hostname`            |`agent.hostname`
|`beat.name`            |`host.name`
|`beat.timezone`            |`event.timezone`
|`beat.version`            |`agent.version`
|`docker.container.id`            |`container.id`
|`docker.container.image`            |`container.image.name`
|`docker.container.labels`            |`container.labels`
|`docker.container.name`            |`container.name`
|`elasticsearch.slowlog.took_millis`            |`event.duration`
|`haproxy.http.request.time_active_ms`            |`event.duration`
|`haproxy.total_waiting_time_ms`            |`event.duration`
|`iis.access.body_received.bytes`            |`http.request.body.bytes`
|`iis.access.body_sent.bytes`            |`http.response.body.bytes`
|`iis.access.request_time_ms`            |`event.duration`
|`meta.cloud.availability_zone`            |`cloud.availability_zone`
|`meta.cloud.instance_id`            |`cloud.instance.id`
|`meta.cloud.instance_name`            |`cloud.instance.name`
|`meta.cloud.machine_type`            |`cloud.machine.type`
|`meta.cloud.project_id`            |`cloud.project.id`
|`meta.cloud.provider`            |`cloud.provider`
|`meta.cloud.region`            |`cloud.region`
|`mysql.slowlog.query_time.sec`            |`event.duration`
|`nginx.access.body_sent.bytes`            |`http.response.body.bytes`
|`postgresql.log.duration`            |`event.duration`
|`process.exe`            |`process.executable`
|`traefik.access.body_sent.bytes`            |`http.response.body.bytes`
|`traefik.access.duration`            |`event.duration`
|======================
```

dev-tools/ecs-migration.yml

@@ -100,7 +100,6 @@
   to: process.executable
   alias: true
 
-
 ## Filebeat
 - from: offset
   to: log.offset
@@ -582,6 +581,7 @@
 - from: apache2.access.body_sent.bytes
   to: http.response.body.bytes
   alias: true
+  beat: filebeat
 
 - from: apache2.access.geoip.continent_name
   to: source.geo.continent_name
@@ -716,6 +716,7 @@
   to: event.duration
   alias: false
   scale: 1000000
+  beat: filebeat
 
 ## IIS module
 
@@ -873,15 +874,18 @@
 - from: iis.access.body_received.bytes
   to: http.request.body.bytes
   alias: true
+  beat: filebeat
 
 - from: iis.access.body_sent.bytes
   to: http.response.body.bytes
   alias: true
+  beat: filebeat
 
 - from: iis.access.request_time_ms
   to: event.duration
   alias: false
   scale: 1000000
+  beat: filebeat
 
 - from: iis.error.method
   to: http.request.method
@@ -934,11 +938,13 @@
   to: event.duration
   alias: false
   scale: 1000000
+  beat: filebeat
 
 - from: haproxy.http.request.time_active_ms
   to: event.duration
   alias: false
   scale: 1000000
+  beat: filebeat
 
 - from: haproxy.client.ip
   to: source.address
@@ -1146,6 +1152,7 @@
   to: event.duration
   alias: false
   scale: 1000000000
+  beat: filebeat
 
 ## NGINX module
 
@@ -1187,6 +1194,7 @@
 - from: nginx.access.body_sent.bytes
   to: http.response.body.bytes
   alias: true
+  beat: filebeat
 
 - from: nginx.access.geoip.continent_name
   to: source.geo.continent_name
@@ -1291,6 +1299,7 @@
   to: event.duration
   alias: false
   scale: 1000000
+  beat: filebeat
 
 - from: postgresql.log.timezone
   to: event.timezone
@@ -1487,11 +1496,13 @@
 - from: traefik.access.body_sent.bytes
   to: http.response.body.bytes
   alias: true
+  beat: filebeat
 
 - from: traefik.access.duration
   to: event.duration
   alias: false
   scale: 1000000
+  beat: filebeat
 
 # Filebeat Redis Input
 

libbeat/docs/breaking.asciidoc

@@ -11,12 +11,24 @@ changes, but there are breaking changes between major versions (e.g. 5.x to
 
 See the following topics for a description of breaking changes:
 
+* <<breaking-changes-7.0>>
 * <<breaking-changes-6.3>>
 * <<breaking-changes-6.2>>
 * <<breaking-changes-6.1>>
 * <<breaking-changes-6.0>>
 * {auditbeat}/auditbeat-breaking-changes.html[Breaking changes in Auditbeat 6.2]
 
+[[breaking-changes-7.0]]
+
+=== Breaking changes in 7.0
+
+This section discusses the main changes that you should be aware of if you
+upgrade the Beats to version 7.0. {see-relnotes}
+
+==== Field name changes
+
+include::./field-name-changes.asciidoc[]
+
 [[breaking-changes-6.3]]
 === Breaking changes in 6.3