Add analyzer multi-field capability

[sektorcap]

Summary
Add support for the analyzer in the ECS field definitions.

Example:

- name: url
  title: URL
  description: URL fields provide support for complete or partial URLs, and supports
    the breaking down into scheme, domain, path, and so on.
  type: group
  fields:
  - name: domain
    level: extended
    type: keyword
    ignore_above: 1024
    multi_fields:
    - name: text
      type: text
      analyzer: domain_analyzer
    description: 'Domain of the url, such as "www.elastic.co".

Example ES index template snippet:

      "url": {
        "properties": {
          "domain": {
            "fields": {
              "text": {
                "analyzer": "domain_analyzer",
                "norms": false,
                "type": "text"
              }
            },
            "ignore_above": 1024,
            "type": "keyword"
          },
...

Of course, in the template-setting you should define the analyzer.

{
  "order": 1,
  "index_patterns": [
    "your-ecs-*"
  ],
  "settings": {
    
    "index": {
      "mapping": {
        "total_fields": {
          "limit": "10000"
        }
      },
      "analysis": {
        "analyzer": {
          "domain_analyzer": {
            "type": "pattern",
            "pattern": "\\."
          }
        }
      },
      "refresh_interval": "5s"
    }
  }
}

[BenB196]

I would like to add another use-case here. Currently url.path is only handled as a keyword, but if you have a long and complex path, and you want to search for paths containing on a specific word(s), you need to resort to wildcard usage. You could use another analyzer like pattern: "/" to parse the paths to be more search friendly.