[ECS] plugin sets top level field names

[kares]

such as doc - these might be problematic with Elastic Common Schema.
a target name-space might be considered for the plugin, given the field-names likely won't have a direct ECS mapping ...