Emit logstash records in ECS 1.7.0 format (v2)
This is a followup to c9a8fa22.
Among other changes, user.* now contains info about the user who
initiated an operation (e.g. through spiderpig) and user.effective.*
will have info about the account running the process (if they're
different).
I used https://doc.wikimedia.org/ecs/validator.html?forcecachemiss=true
to validate that a log record generated with this new code passes the
validator without errors.