Logging UI ECS Migration

[ruflin]

This issue is to track the migration of the Logging UI to ECS.

List of fields which need to be migrated:

• beat.hostname -> host.hostname
• beat.timezone -> event.timezone
• meta.cloud.provider -> cloud.provider
• meta.cloud.instance_id -> cloud.instance.id
• meta.cloud.instance_name -> cloud.instance.name
• meta.cloud.machine_type -> cloud.machine.type
• meta.cloud.availability_zone -> cloud.availability_zone
• meta.cloud.project_id -> cloud.project.id
• meta.cloud.region -> cloud.region
• docker.container.id -> container.id
• docker.container.name -> container.name
• docker.container.image -> container.image.name
• metricset.name -> event.dataset (but different content)
• metricset.module -> event.module
• Module fields (see below).
• Handle change that source becomes log.path and log.source.ip

These are the alias fields that were introduce also in 6.6 / 6.7 to make this data data compatible with the 7.x releases of Infrastructure UI. See elastic/beats#9283 for the actual aliases created in 6.x.

The Logging UI must also migrate the fields which are used for the reconstruction of the events. The migration of the Filebeat modules to ECS is still ongoing (see elastic/beats#8655) but quite a few modules are already migrated to have a look at the new ECS based fields. Each PR is linked in the meta issue.

• Handle changes to nginx fields: Convert Filebeat nginx.access to ECS beats#9081
• Handle changes to apache fields: Convert apache2.access to ECS - Take 2 beats#9245

As soon as this work is done, testing against the 6.x branches must happening to confirm everything works as expected.

[elasticmachine]

Pinging @elastic/infrastructure-ui