Add required version number to audit log

[thomheymann]

Related to elastic/beats#22696

Summary

This PR adds the ECS version number to audit logs.

This is a required field in ECS and should be set at the point of logging, not during ingestion (e.g. in Filebeat).

{
  "@timestamp": "2020-12-09T11:18:40.003+00:00",
  "message": "User is updating config [id=8.0.0]",
  "ecs": {
    "version": "1.6.0"
  },
}

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

[legrego]

LGTM on green CI, with one nit - thanks for opening this!

As an aside, I changed your label from release_note:fix to release_note:skip, since we are fixing something that hasn't shipped yet. There's no need to include this in the public release notes, since there isn't anything that's been fixed from the user's perspective

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: d357bf0

Metrics [docs]

✅ unchanged

History

• 💚 Build #93043 succeeded 4110c2f

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream