Support flattened data_stream.* fields under Elastic-Agent

[belimawr]

Proposed commit message

When an input configuration comes from Elastic-Agent the data_stream.* fields sometimes are flattened (e.g: data_stream.dataset: mystuff), this was not supported by Beats.

This commit enables support for it.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

## Author's Checklist

How to test this PR locally

Configure a standalone Elastic-Agent with a flattened data_stream field, like this:

inputs:
  - type: filestream
    id: unique-id-per-input
    data_stream.dataset: mystuff
    paths:
      - /var/log/my-file/my.log*

Run the Elastic-Agent and assert that the dataset from the events is mystuff.

Related issues

• Closes Support flattened data_stream fields elastic-agent#3191

## Use cases
## Screenshots
## Logs

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @belimawr? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-09-06T09:58:21.226+0000

• Duration: 65 min 56 sec

Test stats 🧪

Test	Results
Failed	0
Passed	8314
Skipped	381
Total	8695

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[leehinman]

LGTM

[ruflin]

Glad to see we test the mixed scenario 👍