Convert read_timestamp to event.created in Journalbeat

[ruflin]

This aligns journalbeat with ECS.

[ruflin]

@kvch Are there other things need in journalbeat that need alignment with ECS?

[kvch]

I think host.name needs to be renamed to host.hostname. Do you want to include that in this PR?

[ruflin]

Trying also to convert it directly in this PR. Can you check if I picked the correct field?

[kvch]

👍

[kvch]

I don't see anything else changed recently.

I am curious if you are planning to add facility and identifier fields in some form to ECS? In journalbeat there are a few syslog fields. I recalled having those in ECS. :)

[ruflin]

@kvch +1 on making these change too. Could you open a PR for it?

[ruflin]

Hm, tests seem to fail because of the changes. I hoped my adjustment works, seems like I need to create a setup. @kvch If you have some hints to get this green, let me know.

[kvch]

The problem is that an empty object is still there with the key "event".

Actual: {"event":{},"host":{"boot_id":"123456"}}
Expected: {"host":{"boot_id":"123456"}}

The whole key-value "pair" has to be deleted:

event.Fields.Delete("event")

[ruflin]

@kvch Thanks for investigating. Let's see if CI is happy with it, if not will spin up a Linux environment for testing.