Update NFS protocol to use ECS fields (#10153)

That dashboard was updated too.

Here's a summary of what fields changed.

Part of #7968

Changed

- rpc.call_size -> source.bytes
- rpc.reply_size -> destination.bytes
- rpc.time -> event.duration (unit are now nanoseconds)

Added

- destination
- event.dataset = nfs
- event.end
- event.start
- network.bytes
- network.community_id
- network.protocol = nfsv4 or nfsv3
- network.transport = tcp
- network.type
- source
- source.domain - set to the caller's RPC machine name

Removed

- rpc.time_str - Kibana should provide a human-readable form for event.duration rather than each event supplying a string.

Unchanged Packetbeat Fields

- status
- type = nfs (we might remove this since we have event.dataset)

CHANGELOG.next.asciidoc

@@ -71,6 +71,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Changed AMQP protocol fields to align with ECS. {pull}10090[10090]
 - Changed Redis protocol fields to align with ECS. {pull}10126[10126]
 - Changed HTTP protocol fields to align with ECS. {pull}9976[9976]
+- Changed NFS protocol fields to align with ECS. {pull}10153[10153]
 - Changed Thrift protocol fields to align with ECS. {pull}10125[10125]
 - Changed Cassandra protocol fields to align with ECS. {pull}10093[10093]
 

dev-tools/ecs-migration.yml

@@ -918,6 +918,28 @@
   to: network.forwarded_ip
   alias: false
 
+## NFS
+- from: rpc.time
+  to: event.duration
+  alias: false
+  comment: >
+    Cannot add alias at this time because the field is used by MongoDB which
+    has not been updated yet.
+
+- from: rpc.call_size
+  to: source.bytes
+  alias: false
+  comment: >
+    Cannot add alias at this time because the field is used by MongoDB which
+    has not been updated yet.
+
+- from: rpc.reply_size
+  to: destination.bytes
+  alias: false
+  comment: >
+    Cannot add alias at this time because the field is used by MongoDB which
+    has not been updated yet.
+
 ## Cassandra
 - from: no_request
   to: cassandra.no_request