[ECS logging] Enable by default

[simitt]

Following up on #17974 let's set the logging.ecs: true as default for 7.12. Since ECS formatter expect JSON format, it would make sense to also set logging.json: true by default.

@kvch and @urso WDYT?

side note: APM Server sets it as default in 7.11.

[elasticmachine]

Pinging @elastic/integrations (Team:Platforms)

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[urso]

In agent we already default to ECS.

How does the change to ECS in Beats by default change the log format?

If possible I would prefer if we do not change the defaults, as this might be a breaking change for users that already process/index Beats logs.

[simitt]

How does the change to ECS in Beats by default change the log format?

It would only make sense in combination with setting logging.json: true - so stdout logs would be in json;
The minimal ECS fields would be added to every log line.

I do not feel strongly about changing or not - up to you; just wanted to open, as originally you were asking for changing to default. Feel free to close the issue if the default should not be changed.

[ruflin]

I filed an ECS logging issue for fleet-server: elastic/fleet-server#206 We should make it a requirement that any process run by the Elastic Agent MUST log in ECS.

@urso You mention above that with Elastic Agent we already default to ECS. Is this only for Elastic Agent logs or also all the process (beats)?

[faec]

Completed by @michel-laterman in #28573.