[libbeat] add_network_direction creates field name that contains a dot

[andrewkroh]

The add_network_direction processor creates field names that contain dots. By default it will create a document that contains

What is does:

{
  "network.direction": "outbound"
}

What is SHOULD do:

{
  "network": {
    "direction": "outbound"
  }
}

The problem is this line that directly uses the target key without considering that it could contain dots.

beats/libbeat/processors/actions/add_network_direction.go

Lines 103 to 105 in ce73772

	event.Fields.DeepUpdate(common.MapStr{
	m.Target: networkDirection(internalSource, internalDestination),
	})

It looks to me like it should use:

event.PutValue(m.Target, networkDirection(internalSource, internalDestination))

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)