We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Incorrect output of the "tracing" fields in the Beats yml file
Just like the `base` fields, the `tracing` fields are not nested under the name of the field set. So it's not `base.@timestamp`, it's `@timestamp`, and it's not `tracing.trace.id`, it's `trace.id`.

In the Beats field yaml file the ECS project generates, the tracing fields are incorrectly nested under a `tracing` section, which means Beats interprets the field names incorrectly (`tracing.trace.id`).

This is a bug, these fields shouldn't be nested this way.

In order to fix this issue, we should remove this nesting in the Beats yml output. Just like `@timestamp` and other base fields are not nested under a field group.

I think this bug fix will be at minimum backported to 1.7. Thoughts welcome on this, is there a need to backport to 1.6 as well?

The Beats PR https://github.com/elastic/beats/pull/22571 to import ECS 1.7 should be adjusted with these changes, once the bug fix is ready. cc @andrewstucki 


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `scripts/generators/beats.py`
Content:
```
1 from os.path import join
2 from collections import OrderedDict
3 from generators import ecs_helpers
4 
5 
6 def generate(ecs_nested, ecs_version, out_dir):
7     # Load temporary whitelist for default_fields workaround.
8     df_whitelist = ecs_helpers.yaml_load('scripts/generators/beats_default_fields_whitelist.yml')
9 
10     # base first
11     beats_fields = fieldset_field_array(ecs_nested['base']['fields'], df_whitelist, ecs_nested['base']['prefix'])
12 
13     allowed_fieldset_keys = ['name', 'title', 'group', 'description', 'footnote', 'type']
14     # other fieldsets
15     for fieldset_name in sorted(ecs_nested):
16         if 'base' == fieldset_name:
17             continue
18         fieldset = ecs_nested[fieldset_name]
19 
20         beats_field = ecs_helpers.dict_copy_keys_ordered(fieldset, allowed_fieldset_keys)
21         beats_field['fields'] = fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix'])
22         beats_fields.append(beats_field)
23 
24     beats_file = OrderedDict()
25     beats_file['key'] = 'ecs'
26     beats_file['title'] = 'ECS'
27     beats_file['description'] = 'ECS Fields.'
28     beats_file['fields'] = beats_fields
29 
30     write_beats_yaml(beats_file, ecs_version, out_dir)
31 
32 
33 def fieldset_field_array(source_fields, df_whitelist, fieldset_prefix):
34     allowed_keys = ['name', 'level', 'required', 'type', 'object_type',
35                     'ignore_above', 'multi_fields', 'format', 'input_format',
36                     'output_format', 'output_precision', 'description',
37                     'example', 'enabled', 'index', 'path', 'scaling_factor']
38     multi_fields_allowed_keys = ['name', 'type', 'norms', 'default_field', 'normalizer', 'ignore_above']
39 
40     fields = []
41     for nested_field_name in source_fields:
42         ecs_field = source_fields[nested_field_name]
43         beats_field = ecs_helpers.dict_copy_keys_ordered(ecs_field, allowed_keys)
44         if '' == fieldset_prefix:
45             contextual_name = nested_field_name
46         else:
47             contextual_name = '.'.join(nested_field_name.split('.')[1:])
48 
49         cleaned_multi_fields = []
50         if 'multi_fields' in ecs_field:
51             for mf in ecs_field['multi_fields']:
52                 # Set default_field if necessary. Avoid adding the key if the parent
53                 # field already is marked with default_field: false.
54                 if not mf['flat_name'] in df_whitelist and ecs_field['flat_name'] in df_whitelist:
55                     mf['default_field'] = False
56                 cleaned_multi_fields.append(
57                     ecs_helpers.dict_copy_keys_ordered(mf, multi_fields_allowed_keys))
58             beats_field['multi_fields'] = cleaned_multi_fields
59 
60         beats_field['name'] = contextual_name
61 
62         if not ecs_field['flat_name'] in df_whitelist:
63             beats_field['default_field'] = False
64 
65         fields.append(beats_field)
66     return sorted(fields, key=lambda x: x['name'])
67 
68 # Helpers
69 
70 
71 def write_beats_yaml(beats_file, ecs_version, out_dir):
72     ecs_helpers.make_dirs(join(out_dir, 'beats'))
73     warning = file_header().format(version=ecs_version)
74     ecs_helpers.yaml_dump(join(out_dir, 'beats/fields.ecs.yml'), [beats_file], preamble=warning)
75 
76 
77 # Templates
78 
79 
80 def file_header():
81     return '''
82 # WARNING! Do not edit this file directly, it was generated by the ECS project,
83 # based on ECS version {version}.
84 # Please visit https://github.com/elastic/ecs to suggest changes to ECS fields.
85 
86 '''.lstrip()
87
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/scripts/generators/beats.py b/scripts/generators/beats.py
--- a/scripts/generators/beats.py
+++ b/scripts/generators/beats.py
@@ -17,6 +17,11 @@
             continue
         fieldset = ecs_nested[fieldset_name]
 
+        # Handle when `root:true`
+        if fieldset.get('root', False):
+            beats_fields.extend(fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix']))
+            continue
+
         beats_field = ecs_helpers.dict_copy_keys_ordered(fieldset, allowed_fieldset_keys)
         beats_field['fields'] = fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix'])
         beats_fields.append(beats_field)

{"golden_diff": "diff --git a/scripts/generators/beats.py b/scripts/generators/beats.py\n--- a/scripts/generators/beats.py\n+++ b/scripts/generators/beats.py\n@@ -17,6 +17,11 @@\n             continue\n         fieldset = ecs_nested[fieldset_name]\n \n+        # Handle when `root:true`\n+        if fieldset.get('root', False):\n+            beats_fields.extend(fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix']))\n+            continue\n+\n         beats_field = ecs_helpers.dict_copy_keys_ordered(fieldset, allowed_fieldset_keys)\n         beats_field['fields'] = fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix'])\n         beats_fields.append(beats_field)\n", "issue": "Incorrect output of the \"tracing\" fields in the Beats yml file\nJust like the `base` fields, the `tracing` fields are not nested under the name of the field set. So it's not `base.@timestamp`, it's `@timestamp`, and it's not `tracing.trace.id`, it's `trace.id`.\r\n\r\nIn the Beats field yaml file the ECS project generates, the tracing fields are incorrectly nested under a `tracing` section, which means Beats interprets the field names incorrectly (`tracing.trace.id`).\r\n\r\nThis is a bug, these fields shouldn't be nested this way.\r\n\r\nIn order to fix this issue, we should remove this nesting in the Beats yml output. Just like `@timestamp` and other base fields are not nested under a field group.\r\n\r\nI think this bug fix will be at minimum backported to 1.7. Thoughts welcome on this, is there a need to backport to 1.6 as well?\r\n\r\nThe Beats PR https://github.com/elastic/beats/pull/22571 to import ECS 1.7 should be adjusted with these changes, once the bug fix is ready. cc @andrewstucki \r\n\n", "before_files": [{"content": "from os.path import join\nfrom collections import OrderedDict\nfrom generators import ecs_helpers\n\n\ndef generate(ecs_nested, ecs_version, out_dir):\n    # Load temporary whitelist for default_fields workaround.\n    df_whitelist = ecs_helpers.yaml_load('scripts/generators/beats_default_fields_whitelist.yml')\n\n    # base first\n    beats_fields = fieldset_field_array(ecs_nested['base']['fields'], df_whitelist, ecs_nested['base']['prefix'])\n\n    allowed_fieldset_keys = ['name', 'title', 'group', 'description', 'footnote', 'type']\n    # other fieldsets\n    for fieldset_name in sorted(ecs_nested):\n        if 'base' == fieldset_name:\n            continue\n        fieldset = ecs_nested[fieldset_name]\n\n        beats_field = ecs_helpers.dict_copy_keys_ordered(fieldset, allowed_fieldset_keys)\n        beats_field['fields'] = fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix'])\n        beats_fields.append(beats_field)\n\n    beats_file = OrderedDict()\n    beats_file['key'] = 'ecs'\n    beats_file['title'] = 'ECS'\n    beats_file['description'] = 'ECS Fields.'\n    beats_file['fields'] = beats_fields\n\n    write_beats_yaml(beats_file, ecs_version, out_dir)\n\n\ndef fieldset_field_array(source_fields, df_whitelist, fieldset_prefix):\n    allowed_keys = ['name', 'level', 'required', 'type', 'object_type',\n                    'ignore_above', 'multi_fields', 'format', 'input_format',\n                    'output_format', 'output_precision', 'description',\n                    'example', 'enabled', 'index', 'path', 'scaling_factor']\n    multi_fields_allowed_keys = ['name', 'type', 'norms', 'default_field', 'normalizer', 'ignore_above']\n\n    fields = []\n    for nested_field_name in source_fields:\n        ecs_field = source_fields[nested_field_name]\n        beats_field = ecs_helpers.dict_copy_keys_ordered(ecs_field, allowed_keys)\n        if '' == fieldset_prefix:\n            contextual_name = nested_field_name\n        else:\n            contextual_name = '.'.join(nested_field_name.split('.')[1:])\n\n        cleaned_multi_fields = []\n        if 'multi_fields' in ecs_field:\n            for mf in ecs_field['multi_fields']:\n                # Set default_field if necessary. Avoid adding the key if the parent\n                # field already is marked with default_field: false.\n                if not mf['flat_name'] in df_whitelist and ecs_field['flat_name'] in df_whitelist:\n                    mf['default_field'] = False\n                cleaned_multi_fields.append(\n                    ecs_helpers.dict_copy_keys_ordered(mf, multi_fields_allowed_keys))\n            beats_field['multi_fields'] = cleaned_multi_fields\n\n        beats_field['name'] = contextual_name\n\n        if not ecs_field['flat_name'] in df_whitelist:\n            beats_field['default_field'] = False\n\n        fields.append(beats_field)\n    return sorted(fields, key=lambda x: x['name'])\n\n# Helpers\n\n\ndef write_beats_yaml(beats_file, ecs_version, out_dir):\n    ecs_helpers.make_dirs(join(out_dir, 'beats'))\n    warning = file_header().format(version=ecs_version)\n    ecs_helpers.yaml_dump(join(out_dir, 'beats/fields.ecs.yml'), [beats_file], preamble=warning)\n\n\n# Templates\n\n\ndef file_header():\n    return '''\n# WARNING! Do not edit this file directly, it was generated by the ECS project,\n# based on ECS version {version}.\n# Please visit https://github.com/elastic/ecs to suggest changes to ECS fields.\n\n'''.lstrip()\n", "path": "scripts/generators/beats.py"}], "after_files": [{"content": "from os.path import join\nfrom collections import OrderedDict\nfrom generators import ecs_helpers\n\n\ndef generate(ecs_nested, ecs_version, out_dir):\n    # Load temporary whitelist for default_fields workaround.\n    df_whitelist = ecs_helpers.yaml_load('scripts/generators/beats_default_fields_whitelist.yml')\n\n    # base first\n    beats_fields = fieldset_field_array(ecs_nested['base']['fields'], df_whitelist, ecs_nested['base']['prefix'])\n\n    allowed_fieldset_keys = ['name', 'title', 'group', 'description', 'footnote', 'type']\n    # other fieldsets\n    for fieldset_name in sorted(ecs_nested):\n        if 'base' == fieldset_name:\n            continue\n        fieldset = ecs_nested[fieldset_name]\n\n        # Handle when `root:true`\n        if fieldset.get('root', False):\n            beats_fields.extend(fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix']))\n            continue\n\n        beats_field = ecs_helpers.dict_copy_keys_ordered(fieldset, allowed_fieldset_keys)\n        beats_field['fields'] = fieldset_field_array(fieldset['fields'], df_whitelist, fieldset['prefix'])\n        beats_fields.append(beats_field)\n\n    beats_file = OrderedDict()\n    beats_file['key'] = 'ecs'\n    beats_file['title'] = 'ECS'\n    beats_file['description'] = 'ECS Fields.'\n    beats_file['fields'] = beats_fields\n\n    write_beats_yaml(beats_file, ecs_version, out_dir)\n\n\ndef fieldset_field_array(source_fields, df_whitelist, fieldset_prefix):\n    allowed_keys = ['name', 'level', 'required', 'type', 'object_type',\n                    'ignore_above', 'multi_fields', 'format', 'input_format',\n                    'output_format', 'output_precision', 'description',\n                    'example', 'enabled', 'index', 'path', 'scaling_factor']\n    multi_fields_allowed_keys = ['name', 'type', 'norms', 'default_field', 'normalizer', 'ignore_above']\n\n    fields = []\n    for nested_field_name in source_fields:\n        ecs_field = source_fields[nested_field_name]\n        beats_field = ecs_helpers.dict_copy_keys_ordered(ecs_field, allowed_keys)\n        if '' == fieldset_prefix:\n            contextual_name = nested_field_name\n        else:\n            contextual_name = '.'.join(nested_field_name.split('.')[1:])\n\n        cleaned_multi_fields = []\n        if 'multi_fields' in ecs_field:\n            for mf in ecs_field['multi_fields']:\n                # Set default_field if necessary. Avoid adding the key if the parent\n                # field already is marked with default_field: false.\n                if not mf['flat_name'] in df_whitelist and ecs_field['flat_name'] in df_whitelist:\n                    mf['default_field'] = False\n                cleaned_multi_fields.append(\n                    ecs_helpers.dict_copy_keys_ordered(mf, multi_fields_allowed_keys))\n            beats_field['multi_fields'] = cleaned_multi_fields\n\n        beats_field['name'] = contextual_name\n\n        if not ecs_field['flat_name'] in df_whitelist:\n            beats_field['default_field'] = False\n\n        fields.append(beats_field)\n    return sorted(fields, key=lambda x: x['name'])\n\n# Helpers\n\n\ndef write_beats_yaml(beats_file, ecs_version, out_dir):\n    ecs_helpers.make_dirs(join(out_dir, 'beats'))\n    warning = file_header().format(version=ecs_version)\n    ecs_helpers.yaml_dump(join(out_dir, 'beats/fields.ecs.yml'), [beats_file], preamble=warning)\n\n\n# Templates\n\n\ndef file_header():\n    return '''\n# WARNING! Do not edit this file directly, it was generated by the ECS project,\n# based on ECS version {version}.\n# Please visit https://github.com/elastic/ecs to suggest changes to ECS fields.\n\n'''.lstrip()\n", "path": "scripts/generators/beats.py"}]}