[RFC] Add host metric fields to ECS (Stage 3)

[kaiyan-sheng]

This PR is stage 3 of the RFC for adding host metric fields into ECS.

Link to the preview of the RFC: https://github.com/kaiyan-sheng/ecs/blob/add_host_fields/rfcs/text/0005-host-metric-fields.md

[ebeahan]

Thanks, @kaiyan-sheng, for adding the section on the real-world implementation!

Could you add one or two additional example source documents? The AWS example format is great; it would be valuable to capture additional examples from other listed sources.

[kaiyan-sheng]

Hi @ebeahan, I just added two more real world example source documents, and please let me know what you think. Thanks!!

[ebeahan]

LGTM

@kaiyan-sheng is there someone that can provide an o11y-side review while @exekias is away?

cc @cyrille-leclerc

[kaiyan-sheng]

@ebeahan Thanks for the review! @jsoriano Could you take a look at this PR please 😬 TIA!!

[dainperkins]

I just noticed Metricbeat is currently using host.network.in|out.bytes|packets, might make a lot of sense to stick with that instead of ingress/egress and updating beats / existing indices, etc.
Its also pretty typical to see interface specific metrics described in a pure in/out perspective as theres no concept of e.g. final destination (azure, aws examples, snmp, etc.), whereas ingress/egress often refers specifically to an l2/l3 network concept of handling packets (e.g. router, switch, firewall netflow reporting)