update _ingest.timestamp to use new ZonedDateTime

[talevy]

Previously, Mustache would call toString on the _ingest.timestamp
field and return a date format that did not match Elasticsearch's
defaults for date-mapping parsing. The new ZonedDateTime class in Java 8
happens to do format itself in the same way ES is expecting.

Fixes #23168.

[rjernst]

While I think this is the correct change long term, I do wonder what, if anything we could or should do for backcompat. Users may already have code using Date, for example in a script processor. /cc @clintongormley

[clintongormley]

Good point @rjernst. All I can think of here is:

• In 5.4, keep the functionality as it is, but allow the new format to be enabled with a setting.
• Add deprecation logging if the setting is not enabled.
• In 6.0, change to the new functionality and remove the setting.

[talevy]

👍 will add a new_format flag or something like that, and update the docs with a discussion around the change and the use-case.

[clintongormley]

@talevy should be a setting rather than a flag i think - easier to remove when they upgrade

[talevy]

@clintongormley ah, I see. didn't think about going into the es settings. that is better. thanks

[elasticmachine]

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

[talevy]

#24030 was introduced to supersede this PR. I hope to merge that one into 5.x and master, then follow-up with a PR to remove the setting flag, and reduce that change to basically what we see here (just for master)