Rename log.path field to log.file.path to be ECS complicant

[kvch]

What does this PR do?

The PR renames log.path to log.file.path in filestream input events.

Why is it important?

The old log.path is not ECS compliant and inconsistent with the old log input.

Checklist

• My code follows the style guidelines of this project
  - [ ] I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
  - [ ] I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Closes #27776

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[ruflin]

It seems this is a breaking change. Will this potentially have some side effects?

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-09-10T11:29:13.004+0000

• Duration: 142 min 48 sec

• Commit: f1c2aeb

Test stats 🧪

Test	Results
Failed	0
Passed	53916
Skipped	5324
Total	59240

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	53916
Skipped	5324
Total	59240

[weltenwort]

ℹ️ The Logs UI already uses log.file.path for its "view in context" feature.

[kvch]

It is a breaking change compared to the previous version. However, everyone expects filestream input to be ECS compliant, so I consider the old behaviour an obstacle for adaptation. It makes moving from log input to filestream input harder if we do not merge this in 7.x.

EDIT: It was reported here on Discuss: https://discuss.elastic.co/t/filebeat-input-types-log-and-filestream-metadata-for-file-path-name-differ/281713
I think the user question is valid, we should follow ECS.

[ruflin]

++ on following ECS. We should likely file it then as bug and breaking change. Any user that has build dashboards or tooling of the existing fields will have issues afterwards.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b fix-filebeat-filestream-log-path-ecs upstream/fix-filebeat-filestream-log-path-ecs
git merge upstream/master
git push upstream fix-filebeat-filestream-log-path-ecs

[kvch]

I have opened an issue as well and added one more entry to the changelog.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b fix-filebeat-filestream-log-path-ecs upstream/fix-filebeat-filestream-log-path-ecs
git merge upstream/master
git push upstream fix-filebeat-filestream-log-path-ecs