[system] Make event.original optional for application, security, and system ata streams

[marc-gr]

What does this PR do?

Makes event.original optional for application, security, and system data streams.

NOTE: In this case, event.original is already present from the winlog and httpjson inputs.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.

Related issues

• Relates event.original optionality across all packages #777

Screenshots

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[elasticmachine]

Pinging @elastic/integrations (Team:Integrations)

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #990 updated

• Start Time: 2021-05-14T11:05:55.462+0000

• Duration: 10 min 17 sec

• Commit: a57ef2b

Test stats 🧪

Test	Results
Failed	0
Passed	264
Skipped	0
Total	264

Trends 🧪

[djptek]

Hi @marc-gr we have an RFC open to Deprecate log.original since in the majority of cases that field could equally be captured as event.original

From a quick grep it looks like event.original has more weight in integrations

% grep -Rw "log.original" ~/git/integrations/packages | wc
     135    3164   32774
% grep -Rw "event.original" ~/git/integrations/packages | wc
     263    2027   41656

I just wanted to check in, in case you might intend to rely on log.original as a result of this PR

[marc-gr]

hey @djptek!

This is part of an effort to be consistent about the way we deal with event.original in general, and the intent is to do not add it by default but have a toggle in all packages to let users enable it at will (#777).

Hope it makes sense 😄

[djptek]

Thanks @marc-gr makes a lot of sense saving resource, I just wanted to check that users would not opt out of event.original on the expectation that they could recover the data from log.original at some point in the future 👍

[P1llus]

LGTM