populate event.dataset to allow for dedicated partitions in "Log Rate" ML job

The Log Rate component of the Logs UI sets up an ML job to look for anomalies in log rate counts by event.dataset. For logs formatted via ecs-logging-java, that field is not set, so the logs show as “unknown” in the Log Rate UI and are grouped together with all other log sources using ecs-logging-java, which removes the out-of-the-box ability to see if one source has an unusual amount of logs.

[felixbarny]

Having seen a demo of the log categorization, it seems like ${service.name}.log (for example my-application.log) would be a good default. There should also be a first class citizen configuration for the dataset like this:

    encoder(EcsEncoder) {
        serviceName = "my-service"
        eventDataset = "my-service.logins"
    }

[mbarretta]

@felixbarny LGTM.

For doc purposes, the groovy config for this (and the encoder) looks like:

    encoder(EcsEncoder) {
        serviceName = "my-service"
        additionalField(EcsEncoder.Pair) {
            key="event.dataset"
            value="my-service"
        }
    }