Update flows to use event.dataset

CHANGELOG.next.asciidoc

@@ -133,6 +133,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Packetbeat*
 
 - Add `network.community_id` to Packetbeat flow events. {pull}10061[10061]
+- Add aliases for flow fields that were renamed. {issue}7968[7968] {pull}10063[10063]
 
 *Functionbeat*
 

dev-tools/ecs-migration.yml

@@ -830,6 +830,40 @@
   alias: false
   comment: Don't add an alias until all of Packetbeat stops using this field.
 
+## Flows
+- from: flow_id
+  to: flow.id
+  alias: true
+
+- from: final
+  to: flow.final
+  alias: true
+
+- from: start_time
+  to: event.start
+  alias: true
+
+- from: last_time
+  to: event.end
+  alias: true
+
+- from: source.stats.net_bytes_total
+  to: source.bytes
+  alias: true
+
+- from: source.stats.net_packets_total
+  to: source.packets
+  alias: true
+
+- from: dest.stats.net_bytes_total
+  to: destination.bytes
+  alias: true
+
+- from: dest.stats.net_packets_total
+  to: destination.packets
+  alias: true
+
+
 # Heartbeat
 
 - from: monitor.scheme

packetbeat/_meta/fields.common.yml

@@ -89,6 +89,41 @@
         this field will be an array with the outer tag's VLAN identifier listed
         first.
 
+    - name: flow_id
+      type: alias
+      path: flow.id
+      migration: true
+
+    - name: final
+      type: alias
+      path: flow.final
+      migration: true
+
+    - name: vlan
+      type: alias
+      path: flow.vlan
+      migration: true
+
+    - name: source.stats.net_bytes_total
+      type: alias
+      path: source.bytes
+      migration: true
+
+    - name: source.stats.net_packets_total
+      type: alias
+      path: source.packets
+      migration: true
+
+    - name: dest.stats.net_bytes_total
+      type: alias
+      path: destination.bytes
+      migration: true
+
+    - name: dest.stats.net_packets_total
+      type: alias
+      path: destination.packets
+      migration: true
+
 - key: trans_event
   title: "Transaction Event"
   description: >