geoip processor should be ECS compliant by default

[martijnvg]

As reported in #48715, the geoip processor should follow the field naming according ECS.
For example asn should be stored in asn.number field and organization_name should be stored in asn.organization.name field. We should also check for other fields. This field names are configurable, so it is not really problematic, but it would be better if by default ECS complaint field names are used.

[elasticmachine]

Pinging @elastic/es-core-features (:Core/Features/Ingest)

[philippkahr]

Hi @martijnvg

I think we should also ping the beats guys on this. They have a workaround in their beats such as filebeat netflow module to rename the fields correctly:

- geoip:
        database_file: GeoLite2-ASN.mmdb
        field: destination.ip
        target_field: destination.as
        properties:
            - asn
            - organization_name
        ignore_missing: true
 - rename:
       field: source.as.asn
       target_field: source.as.number
       ignore_missing: true

https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/netflow/log/ingest/pipeline.yml