Cherry-pick #22571 to 7.x: Upgrade to ECS 1.7.0 (#22938)

* Upgrade to ECS 1.7.0 (#22571)

* Upgrade to ECS 1.7.0

* Update changelog

* remove user.effective fields from custom fields and update functionbeat

* Run make update (not mage update) on heartbeat

* Add in dns.address and re-update all beats

* fix x-pack metricbeat host processor

* Update to released ECS 1.7

* update to fixed ECS

* Fix bad filebeat ECS name

* metricset -> fileset

* Fix up expected load balancer log

* Fix up alb expected log

(cherry picked from commit a551b25)

* remove unnecessary epr file

CHANGELOG.next.asciidoc

@@ -26,6 +26,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Remove redundant `cloudfoundry.*.timestamp` fields. This value is set in `@timestamp`. {pull}21175[21175]
 - Allow embedding of CAs, Certificate of private keys for anything that support TLS in ouputs and inputs https://github.com/elastic/beats/pull/21179
 - API address is a required setting in `add_cloudfoundry_metadata`. {pull}21759[21759]
+- Update to ECS 1.7.0. {pull}22571[22571]
 
 *Auditbeat*
 
@@ -54,6 +55,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add support for GMT timezone offsets in `decode_cef`. {pull}20993[20993]
 - API address and shard ID are required settings in the Cloud Foundry input. {pull}21759[21759]
 - Remove `suricata.eve.timestamp` alias field. {issue}10535[10535] {pull}22095[22095]
+- Rename bad ECS field name tracing.trace.id to trace.id in aws elb fileset. {pull}22571[22571]
 
 *Heartbeat*
 

auditbeat/_meta/fields.common.yml

@@ -66,27 +66,6 @@
         type: keyword
         description: Audit user name.
 
-    - name: effective
-      type: group
-      description: Effective user information.
-      fields:
-      - name: id
-        type: keyword
-        description: Effective user ID.
-      - name: name
-        type: keyword
-        description: Effective user name.
-      - name: group
-        type: group
-        description: Effective group information.
-        fields:
-        - name: id
-          type: keyword
-          description: Effective group ID.
-        - name: name
-          type: keyword
-          description: Effective group name.
-
     - name: filesystem
       type: group
       description: Filesystem user information.

auditbeat/cmd/root.go

@@ -35,7 +35,7 @@ const (
 	Name = "auditbeat"
 
 	// ecsVersion specifies the version of ECS that Auditbeat is implementing.
-	ecsVersion = "1.5.0"
+	ecsVersion = "1.7.0"
 )
 
 // RootCmd for running auditbeat.