Support data streams and composable templates

[jalvz]

Conclusions from the proposal doc and follow-up conversations:

• In the initial 7.11 release we will omit service.name from the data streams, but we will follow up with this in 7.12 or whenever we progress to Beta. This is a requirement to enable constant_keyword on the field (faster searches), avoid conflicts on labels and metrics, improve field suggestions, and more.
• We will create a single traces-<service.name>-* data stream per service, including both transactions and spans. We should test this approach using real data, compared to having separate data streams, e.g. to compare relative compression, search speed, etc. We should also investigate consolidating the fields used in transactions and spans.
• We will have three metrics data streams:
  • metrics-<service.name>-* (runtime/process/system and application-defined metrics)
  • metrics-<service.name>.apm.internal-* (APM-internal metrics, e.g. span breakdown, transaction duration, edge metrics)
  • metrics-<service.name>.profiling-* (CPU/heap profiling metrics)
• We will have two logs data stream:
  • logs-<service.name>-* (application logs)
  • logs-<service.name>.apm.error-* (APM errors)

Note: errors may end up being partially duplicated in the application logs and APM errors specific data streams. We will need enhancements to the Logs app to collapse multiple docs, e.g. by matching on an error.id field and adding the APM error doc as a pseudo-field of the log in the flyout.

---

Follows from #3824

Beats ref elastic/beats#17829
POC elastic/beats@819d119

[axw]

APM Indexing Strategy Proposal document

[axw]

elastic/package-spec#64 is open for adding package support to include service.name in the data set.