Keep track of elastic/elasticsearch#37329.
If the changes get merged in time for 7.0 ensure we change the user_agent_parsed (introduced in #1783) to user_agent and that fields get indexed.
Otherwise ensure that in time for 7.0 we either
- index the current
user_agent_parsed fields or
- overwrite ECS definitions from beats and move and index the information under
user_agent with the downside that it is not ECS compliant.