Logging improvements

[pgomulka]

This is a meta issue to gather changes and improvements to Elasticsearch logging.

• Allow adding custom new fields to JSON logs [Logging] Support for ECS and custom event tags #46119 PR merged Refactor ESLogMessage to not define fields upfront #46702
• Migrate JSON logs to ECS [Logging] Support for ECS and custom event tags #46119 with a possibility to fall back to old style JSON logs PR
• Remove plaintext slow log and deprecation logs [Logging] Support for ECS and custom event tags #46119
• Sanitise slow log request source Sanitise slow log's request source #47853
• Filebeat changes to make it compatible with ES - ECS Json logs filebeat PR and branch with code to generate logs
• Updated documentation on ES JSON logging
• Rename custom log fields with es prefix
• Use ECS fields where possible (e.g. node.name -> service.node.name)
• Write deprecation logs to an index Write deprecation logs to an index #46106
• Group slow logs fields per index/shard. At the moment it is not obvious if a field took or total_hits relates to an index or to a shard.
• Refactor ESLoggerUsageChecker - this is a static analysis tool to verify correct usages of logger. It is all in one class now and grew too big. Might do with refactoring
• (DeprecationLogger) Eliminate deprecation key by caching call site - https://github.com/elastic/elasticsearch/pull/55941/files#r424563049
• considering reducing memory footprint/garbage creation within DeprecationLogger fluent builder (REMOVED fluent builder)
• Investigate name = "deprecation." + name; in DeprecationLogger, was it working? is it broken? remove it?

[elasticmachine]

Pinging @elastic/es-core-infra (:Core/Infra/Logging)

[tumile]

@pgomulka Hi, I'd like to help with refactoring ESLoggerUsageChecker. Could you assign it to me?

[pgomulka]

@tumile I don't have the exact plan on how to refactor this yet. I was hoping there is a tool that would achieve what that tool is doing. If you came up with ideas, please share them with us (new issue would be good) before you start working on implementation.

[rjernst]

It's been a while since we've opened this, and most of the work here was completed. I'm going to close this given a lack of traction or priority on the remaining small issues.