Cherry-pick #20420 to 7.x: Move to datastream instead of dataset

[michalpristas]

Cherry-pick of PR #20420 to 7.x branch. Original message:

What does this PR do?

This PR moves away from dataset.* fields and uses datastream.* fields instead.
It also requires fleet to send configuration with new fields in inputs definition.

This PR includes config change on top of event decorators.

Why is it important?

elastic/integrations#213
elastic/elasticsearch#60592

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

[elasticmachine]

Pinging @elastic/ingest-management (Team:Ingest Management)

[blakerouse]

Backport looks good.

[elasticmachine]

💚 Build Succeeded

Expand to view the summary

Build stats

• Build Cause: [Pull request #20481 opened]

• Start Time: 2020-08-06T16:23:52.521+0000

• Duration: 61 min 42 sec

[ruflin]

@michalpristas When I got the email notification from this PR I was worried you renamed to datastream instead of data_stream. But the code LGTM. Could you update the PR description and please be careful around these nits ;-)