Add notice to the tracing field set, about not nesting field names.

CHANGELOG.next.md

@@ -42,6 +42,9 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+* Added a notice highlighting that the `tracing` fields are not nested under the
+  namespace `tracing.` #1162
+
 #### Deprecated
 
 

docs/field-details.asciidoc

@@ -7187,6 +7187,8 @@ example: `tls`
 
 Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view. This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.
 
+Unlike most field sets in ECS, the tracing fields are *not* nested under the field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`, and so on.
+
 [discrete]
 ==== Tracing Field Details
 

experimental/generated/beats/fields.ecs.yml

@@ -5215,10 +5215,14 @@
   - name: tracing
     title: Tracing
     group: 2
-    description: Distributed tracing makes it possible to analyze performance throughout
+    description: 'Distributed tracing makes it possible to analyze performance throughout
       a microservice architecture all in one view. This is accomplished by tracing
       all of the requests - from the initial web request in the front-end service
       - to queries made through multiple back-end services.
+
+      Unlike most field sets in ECS, the tracing fields are *not* nested under the
+      field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`,
+      and so on.'
     type: group
     fields:
     - name: span.id

experimental/generated/ecs/ecs_nested.yml

@@ -9228,10 +9228,14 @@ tls:
   title: TLS
   type: group
 tracing:
-  description: Distributed tracing makes it possible to analyze performance throughout
+  description: 'Distributed tracing makes it possible to analyze performance throughout
     a microservice architecture all in one view. This is accomplished by tracing all
     of the requests - from the initial web request in the front-end service - to queries
     made through multiple back-end services.
+
+    Unlike most field sets in ECS, the tracing fields are *not* nested under the field
+    set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`,
+    and so on.'
   fields:
     span.id:
       dashed_name: span-id

generated/beats/fields.ecs.yml

@@ -5302,10 +5302,14 @@
   - name: tracing
     title: Tracing
     group: 2
-    description: Distributed tracing makes it possible to analyze performance throughout
+    description: 'Distributed tracing makes it possible to analyze performance throughout
       a microservice architecture all in one view. This is accomplished by tracing
       all of the requests - from the initial web request in the front-end service
       - to queries made through multiple back-end services.
+
+      Unlike most field sets in ECS, the tracing fields are *not* nested under the
+      field set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`,
+      and so on.'
     type: group
     fields:
     - name: span.id

generated/ecs/ecs_nested.yml

@@ -9316,10 +9316,14 @@ tls:
   title: TLS
   type: group
 tracing:
-  description: Distributed tracing makes it possible to analyze performance throughout
+  description: 'Distributed tracing makes it possible to analyze performance throughout
     a microservice architecture all in one view. This is accomplished by tracing all
     of the requests - from the initial web request in the front-end service - to queries
     made through multiple back-end services.
+
+    Unlike most field sets in ECS, the tracing fields are *not* nested under the field
+    set name. In other words, the correct field name is `trace.id`, not `tracing.trace.id`,
+    and so on.'
   fields:
     span.id:
       dashed_name: span-id

schemas/tracing.yml

@@ -6,7 +6,12 @@
   short: Fields related to distributed tracing.
   description: >
     Distributed tracing makes it possible to analyze performance throughout a microservice architecture all in one view.
-    This is accomplished by tracing all of the requests - from the initial web request in the front-end service - to queries made through multiple back-end services.
+    This is accomplished by tracing all of the requests - from the initial web
+    request in the front-end service - to queries made through multiple back-end services.
+
+    Unlike most field sets in ECS, the tracing fields are *not* nested under the
+    field set name. In other words, the correct field name is `trace.id`,
+    not `tracing.trace.id`, and so on.
   type: group
   fields:
     - name: trace.id