Convert Filebeat iis.error to ECS and add IPv6 zone support for IIS access logs

[webmat]

Caveats

• Now filtering zone from both IP fields. Using and keeping the .address field to keep the raw address around, and .ip field is only set with the IP value without the zone.
• Realized that the access logs were still vulnerable to the Microsoft IPv6 zone literal problem. Fixed it in this PR.

Renames

• read_timestamp => event.created
• iis.error.remote_ip => source.address
• iis.error.remote_port => source.port
• iis.error.server_ip => destination.address
• iis.error.server_port => destination.port
• iis.error.http_version => http.version
• iis.error.method => http.request.method
• iis.error.url => url.original
• iis.error.response_code => http.response.status_code
• iis.error.geoip.* => source.geo.*

Alias adjustments in iis.access

• iis.access.remote_ip => source.address (instead of .ip)
• iis.access.server_ip => destination.address (instead of .ip)

TODO

• Add IPv6 zone support to access logs as well (like Handle IPv6 zone id in IIS filebeat ingest pipeline #9869 did for error logs)
• Coerce some int fields
• read_timestamp => event.created
• Alias renamed fields to their ECS counterpart
• Document field migrations in ecs-migration.yml
• Revisit iis.access to fix the potential zone problem there too, using the .address fields
  • Fix the aliases to .address
• Changelog

[webmat]

jenkins, test this

[webmat]

@ruflin ready for a review. Only Jenkins failures are flaky tests unrelated to Filebeat

[ruflin]

I filed an issue here for the flaky test: #9987

[webmat]

Rebased to fix a conflict.

This reminded me that in migrating iis.error to ECS, I also updated iis.access again, to tackle two things:

• Support for Microsoft IPv6 zones (like Handle IPv6 zone id in IIS filebeat ingest pipeline #9869 did for error logs)
• Use the dual .address + .ip fields. I did not initially use .address, but it was a great fit for the IP with zone, prior to copying the cleaned up IP address to the .ip field.

I've also updated the PR title to reflect this. @ruflin Ok with killing two birds with one PR? ;-)

[ruflin]

LGTM.

I resolved the changelog conflict.

[jsoriano]

Thanks for adding the IPv6 support to the access fileset too, this part would need to be backported as has been done with #9869.

[webmat]

@jsoriano Yes, noted. I'll do that later today.

The backport will cover the support for zone in the IP address, but will not introduce the .address field, to be consistent.

Shall I create a brand new PR just for this on 6.x, and then backport to 6.6 as well, for 6.6.1? Or should I hold off for 6.6? I'm unsure about the exact timing of the procedure :-)