AbstractEcsLoggingTest should log keys as nested objects, not with dotted key names

I’ve noticed AbstractEcsLoggingTest checks for keys like process.thread.name while I think the key should be something like `“process”: { “thread”: { “name”: “co.elastic.logging.logback.EcsEncoderTest”}}" instead of something like

 {"@timestamp":"2019-11-18T13:42:33.333Z","log.level":"DEBUG","message":"test","service.name":"test","process.thread.name":"main","log.logger":"co.elastic.logging.logback.EcsEncoderTest","log.origin":{"file.name":"AbstractEcsEncoderTest.java","function":"debug","file.line":47}}

[felixbarny]

Update: Converting dotted fields to nested objects is now possible both in Beats with the expand_keys option of the decode_json_fields processor and as of 7.15.0, it will also be possible with the dot_expander Elasticsearch ingest node processor. This issue contains a POC for a ingest node pipeline that auto-detects and properly parses ECS JSON: https://github.com/elastic/integrations/issues/1454

[Fr33Radical]

If we can live with the fact of having nested json with no exception. Then, is there a way to achieve this without filebeat? (Waiting for the fix).