Update HTTP protocol to use ECS fields

CHANGELOG.next.asciidoc

@@ -59,6 +59,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Removed trailing dot from domain names reported by the DNS protocol. {pull}9941[9941]
 - Changed TLS protocol fields to align with ECS. {pull}9980[9980]
 - Changed ICMP protocol fields to align with ECS. {pull}10062[10062]
+- Changed HTTP protocol fields to align with ECS. {pull}9976[9976]
 
 *Winlogbeat*
 

dev-tools/ecs-migration.yml

@@ -764,18 +764,6 @@
   to: process.executable
   alias: true
 
-# Packetbeat
-
-- from: http.request.body
-  to: http.request.body.content
-  alias6: false
-  alias: false
-
-- from: http.response.body
-  to: http.response.body.content
-  alias6: false
-  alias: false
-
 
 # Metricbeat
 
@@ -805,6 +793,7 @@
   alias: false
   comment: No alias mapping as field did not always exist
 
+
 # Packetbeat
 
 ## Shared
@@ -868,6 +857,40 @@
   to: destination.packets
   alias: true
 
+## HTTP
+- from: http.request.body
+  to: http.request.body.content
+  alias: false
+
+- from: http.response.body
+  to: http.response.body.content
+  alias: false
+
+- from: http.response.code
+  to: http.response.status_code
+  alias: true
+
+- from: http.response.phrase
+  to: http.response.status_phrase
+  alias: true
+
+- from: http.request.params
+  to: url.query
+  alias: true
+
+- from: method
+  to: http.request.method
+  alias: false
+  comment: method is used by other protocols.
+
+- from: path
+  to: url.path
+  alias: false
+
+- from: real_ip
+  to: network.forwarded_ip
+  alias: false
+
 
 # Heartbeat