Fix bug #495

[webmat]

Most reusable field sets in ECS are not expected at the root of the documents. As of ECS 1.5.0:

reusable field set	expected at root
as	no
code_signature	no
geo	no
group	yes
hash	no
interface	no
os	no
pe	no
user	yes
vlan	no

Unfortunately, ever since the introduction of reusable fields, these field sets remained defined at the root nonetheless, for some of the generated artifacts.

The official documentation correctly mentions which field sets were expected at the root and which weren't. This issue however affected the following artifacts:

• 'ecs_flat.yml'
• the csv
• the Elasticsearch sample templates
• Beats field definition file

This PR does not affect the Beats field definitions for now. Even if they weren't meant to be defined there, we first need confirmation whether they've actually been used.

This PR only fixes the issue for the first 3 artifacts.

Note about 'ecs_nested.yml': this file mixes two types of information. Information about field sets, and information about field definitions. Consumers of this file must make sure to check the attribute reusable.top_level. You should skip defining fields at the root for any field sets where reusable.top_level: false.

[webmat]

For awareness @elastic/ecs-logging. Please make sure to review the note at the end of the PR body.

[webmat]

Whoa, just found a subtle bug where our Makefile's empty include would mean we skip the generation of the Beats file and the docs. Thankfully this issue was only introduced recently and didn't affect us.

Fixed in 6382d26 :)

[marshallmain]

LGTM