Fix timestamp as object at root level for APM Server

[eyalkoren]

APM Server uses timestamp.us at documents root level. When sending data with such field to a logs-*-* data stream, indexing fails with: failed to parse field [timestamp] of type [date] in document with id '<id>'.
This happens because it clashes with the ECS dynamic template that maps timestamp fields to a date.

The preferable solution would be to still automatically map such fields to date if they are of suitable candidate type (string, long or double). We would have relied on match_mapping_type, but this setting doesn't support multiple type values and creating multiple dynamic templates to same patterns with different match_mapping_type make them clash with each other. Two possible enhancements can work well for our purpose:

• make match_mapping_type support array of types
• add unmatch_mapping_type, which we would use to unmatch object type

For now, the quick fix would be to remove only the path_match: timestamp mapping, thus still support nested fields (like code_signature.timestamp)

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)

[elasticsearchmachine]

Hi @eyalkoren, I've created a changelog YAML for you.

[eyalkoren]

I used the ECS testing utility to verify that all current ECS fields are still covered with the modified state of the ECS dynamic templates.

[dakrone]

LGTM

[elasticsearchmachine]

💔 Backport failed

The backport operation could not be completed due to the following error:

An unhandled error occurred. Please consult the logs 

You can use sqren/backport to manually backport by running backport --upstream elastic/elasticsearch --pr 97401