Remove .log suffix from default event.dataset

[felixbarny]

The .log suffix in event.dataset is considered bad practice, according to @ruflin.
Instead of my_service.log, my_service is preferred for the event.dataset.

@weltenwort do you agree with that?

See also the discussion in elastic/beats#27404 (comment)

Having .log in the dataset name is a bit unfortunate. That it is a log should be defined by the type already. Lets remove it.

[apmmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-08-30T04:24:00.405+0000

• Duration: 6 min 6 sec

• Commit: a07e714

Trends 🧪

[ruflin]

LGTM

I tried to figure out where this .log is coming from. There are some datasets where we used .log. This predates the data stream naming scheme and data_stream.* fields. If I remember correctly we did this to differentiate the logs from the metrics dataset. But with data_stream.type this differentiation is done by an additional field and it is now even in a different index so this is not needed anymore.

[felixbarny]

ECS loggers aim to be compatible with older ES versions so we should also think about legacy indices.

However, event.dataset and data_stream.dataset must have the same value. I think it's also not a big loss to not have the .log suffix in legacy indices.
ECS loggers don't support setting data_stream.dataset yet, but there's a draft PR open: #38. There's an outstanding Beats issue to make sure that Filebeat doesn't override data_stream.dataset if it's present in the logs.

[basepi]

This will also need to be fixed here: https://github.com/elastic/apm/blob/7544c0ba7d8ead1cc13ebc477b106cf1be2088e0/specs/agents/log-onboarding.md#eventdataset

[weltenwort]

From the Logs UI perspective there is no dependency on specific dataset suffixes, so this sounds fine by me.