[aws] Change log.file.path field in awscloudwatch input to nested obj…

…ect (#41099)

Change log.file.path field in awscloudwatch input to nested object

(cherry picked from commit 904d14b)

# Conflicts:
#	x-pack/filebeat/input/awscloudwatch/input_test.go

CHANGELOG.next.asciidoc

@@ -26,6 +26,23 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Removed deprecated Cylance from Beats. See <<migrate-from-deprecated-module>> for migration options. {pull}38037[38037]
 - Removed deprecated Bluecoat from Beats. See <<migrate-from-deprecated-module>> for migration options. {pull}38037[38037]
 - Introduce input/netmetrics and refactor netflow input metrics {pull}38055[38055]
+- Update Salesforce module to use new Salesforce input. {pull}37509[37509]
+- Tag events that come from a filestream in "take over" mode. {pull}39828[39828]
+- Fix high IO and handling of a corrupted registry log file. {pull}35893[35893]
+- Enable file ingestion to report detailed status to Elastic Agent {pull}40075[40075]
+- Filebeat, when running with Elastic-Agent, reports status for Filestream input. {pull}40121[40121]
+- Implement Elastic Agent status and health reporting for Winlog Filebeat input. {pull}40163[40163]
+- Fix filestream's registry GC: registry entries will never be removed if clean_inactive is set to "-1". {pull}40258[40258]
+- Added `ignore_empty_values` flag in `decode_cef` Filebeat processor. {pull}40268[40268]
+- Added support for hyphens in extension keys in `decode_cef` Filebeat processor. {pull}40427[40427]
+- Journald: removed configuration options `include_matches.or`, `include_matches.and`, `backoff`, `max_backoff`, `cursor_seek_fallback`. {pull}40061[40061]
+- Journald: `include_matches.match` now behaves in the same way as matchers in `journalctl`. Users should carefully update their input configuration. {pull}40061[40061]
+- Journald: `seek` and `since` behaviour have been simplified, if there is a cursor (state) `seek` and `since` are ignored and the cursor is used. {pull}40061[40061]
+- Redis: Added replication role as a field to submitted slowlogs
+- Added `container.image.name` to `journald` Filebeat input's Docker-specific translated fields. {pull}40450[40450]
+- Change log.file.path field in awscloudwatch input to nested object. {pull}41099[41099]
+- Remove deprecated awscloudwatch field from Filebeat. {pull}41089[41089]
+
 
 *Heartbeat*
 

x-pack/filebeat/input/awscloudwatch/input_test.go

@@ -29,11 +29,18 @@ func TestCreateEvent(t *testing.T) {
 		"event": mapstr.M{
 			"id": *logEvent.EventId,
 		},
+<<<<<<< HEAD
 		"log.file.path": "logGroup1" + "/" + *logEvent.LogStreamName,
 		"awscloudwatch": mapstr.M{
 			"log_group":      "logGroup1",
 			"log_stream":     *logEvent.LogStreamName,
 			"ingestion_time": time.Unix(*logEvent.IngestionTime/1000, 0),
+=======
+		"log": mapstr.M{
+			"file": mapstr.M{
+				"path": "logGroup1" + "/" + *logEvent.LogStreamName,
+			},
+>>>>>>> 904d14b664 ([aws] Change log.file.path field in awscloudwatch input to nested object (#41099))
 		},
 		"aws.cloudwatch": mapstr.M{
 			"log_group":      "logGroup1",

x-pack/filebeat/input/awscloudwatch/processor.go

@@ -44,8 +44,12 @@ func createEvent(logEvent types.FilteredLogEvent, logGroup string, regionName st
 	event := beat.Event{
 		Timestamp: time.Unix(*logEvent.Timestamp/1000, 0).UTC(),
 		Fields: mapstr.M{
-			"message":       *logEvent.Message,
-			"log.file.path": logGroup + "/" + *logEvent.LogStreamName,
+			"message": *logEvent.Message,
+			"log": mapstr.M{
+				"file": mapstr.M{
+					"path": logGroup + "/" + *logEvent.LogStreamName,
+				},
+			},
 			"event": mapstr.M{
 				"id":       *logEvent.EventId,
 				"ingested": time.Now(),