Fix timestamp as object at root level for APM Server (#97401)

Author: eyalkoren

docs/changelog/97401.yaml

@@ -0,0 +1,5 @@
+pr: 97401
+summary: Accept timestamp as object at root level
+area: Data streams
+type: bug
+issues: []

modules/data-streams/src/yamlRestTest/resources/rest-api-spec/test/data_stream/240_logs_ecs_mappings.yml

@@ -197,6 +197,7 @@ Test general mockup ECS mappings:
  {
  "start_timestamp": "not a date",
  "start-timestamp": "not a date",
+ "timestamp.us": 1688550340718000,
  "test": "mockup-ecs-log",
  "registry": {
  "data": {
@@ -234,6 +235,7 @@ Test general mockup ECS mappings:
  "path": "/path/to/my/file",
  "target_path": "/path/to/my/file"
  },
+ "code_signature.timestamp": "2023-07-05",
  "registry.data.strings": ["C:\\rta\\red_ttp\\bin\\myapp.exe"]
  },
  "error": {
@@ -376,6 +378,8 @@ Test general mockup ECS mappings:
  - match: { .$idx0name.mappings.properties.start_timestamp.type: "date" }
  # testing the default mapping of string input fields to keyword if not matching any pattern
  - match: { .$idx0name.mappings.properties.start-timestamp.type: "keyword" }
+ - match: { .$idx0name.mappings.properties.timestamp.properties.us.type: "long" }
+ - match: { .$idx0name.mappings.properties.parent.properties.code_signature.properties.timestamp.type: "date" }
  - match: { .$idx0name.mappings.properties.vulnerability.properties.score.properties.base.type: "float" }
  - match: { .$idx0name.mappings.properties.vulnerability.properties.score.properties.temporal.type: "float" }
  - match: { .$idx0name.mappings.properties.vulnerability.properties.score.properties.version.type: "keyword" }

x-pack/plugin/core/src/main/resources/ecs-dynamic-mappings.json

@@ -124,7 +124,6 @@
  "type": "date"
  },
  "path_match": [
- "timestamp",
  "*.timestamp",
  "*_timestamp",
  "*.not_after",