Rename add_locale to add_timezone

[andrewkroh]

The new add_locale processor adds time zone information to events. I think it would be more clear to simply call it add_timezone. So let's rename it and update the documentation.

[ruflin]

I just realised that we add independent of the format config all under the same field. Based on this add_timezone makes more sense but I would argue that dependent on the config options a different field should be added, like beat.locale.timezone, beat.locale.*. So if someone queries for one of the fields or wants to do some processing on it, the format will always be the same.

[andrewkroh]

Currently there are two mutually exclusive formats -- offset and abbreviation.

How about a rename to add_timezone and make the fields

• beat.timezone.offset
• beat.timezone.abbrev

and you can pick and choose which to add.

processors:
- add_timezone:
    fields: [offset, abbrev]

[ruflin]

SGTM: I somehow thought we have 3 but seems like we dropped one option: #3974 (comment) The above will also work with more options.

[andrewkroh]

I don't think there much benefit to rename it now. It's been released for too long and adopted by many configs.