Document event.dataset and clarify service.id/service.name for ECH/ECE logging

[rseldner]

Clarified logging field descriptions and added event.dataset details across the doc.

• Field table:
  • added event.dataset row, expanded service.name for APM/Fleet Server, added filtering explainer
  • corrected service.id as the reliable field for identifying a deployment; service.name is inconsistently populated across {{es}} log categories and reflects the component (not the deployment) for APM/Fleet Serve
  • noted service.type can hold multiple values on a single log entry (for example, [agent, fleet-server])
• Elasticsearch: added dataset values to existing bullets (audit, slowlog, verbose), added new GC and deprecation bullets
• Kibana: added dataset values for standard and audit logs
• Other components: noted APM/Fleet Server/Agent share agent.log, with service.name as the differentiator and that service.type/service.name can be multivalued on these logs.

Supporting info from a 9.5.2 deployment:

POST _query?format=txt
{
  "query": """FROM elastic-cloud-logs-*
| STATS doc_count = COUNT(*),
        service.type = VALUES(service.type),
        service.name = VALUES(service.name),
        deployment.name = VALUES(deployment.name),
        service.id = VALUES(service.id)
  BY event.dataset
| SORT event.dataset
"""
}

   doc_count   |    service.type     |                service.name                 | deployment.name |           service.id           |           event.dataset            
---------------+---------------------+---------------------------------------------+-----------------+--------------------------------+------------------------------------
32352          |[agent, fleet-server]|[my-deployment-123, fleet-server, apm-server]|null             |xxxxxxxx3223f484bb1f28d680fc4e7cd|agent.log                           
1811796        |elasticsearch        |null                                         |my-deployment-123|xxxxxxxx3223f484bb1f28d680fc4e7cd|elasticsearch.audit                 
8              |elasticsearch        |ES_ECS                                       |my-deployment-123|xxxxxxxx3223f484bb1f28d680fc4e7cd|elasticsearch.deprecation           
176508         |elasticsearch        |null                                         |my-deployment-123|xxxxxxxx3223f484bb1f28d680fc4e7cd|elasticsearch.gc                    
934            |elasticsearch        |ES_ECS                                       |my-deployment-123|xxxxxxxx3223f484bb1f28d680fc4e7cd|elasticsearch.index_indexing_slowlog
40             |elasticsearch        |ES_ECS                                       |my-deployment-123|xxxxxxxx3223f484bb1f28d680fc4e7cd|elasticsearch.index_search_slowlog  
3174           |elasticsearch        |ES_ECS                                       |my-deployment-123|xxxxxxxx3223f484bb1f28d680fc4e7cd|elasticsearch.server                
4407           |kibana               |my-deployment-123                            |null             |xxxxxxxx3223f484bb1f28d680fc4e7cd|kibana.audit                        
5776           |kibana               |my-deployment-123                            |null             |xxxxxxxx3223f484bb1f28d680fc4e7cd|kibana.log                          
             

☝️ did not yet add deployment.name to doc as it does not appear outside of service.type: elasticsearch. But then again ,it is better than service.name for elasticsearch logs.

Summary

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 1 warning, 1 suggestion found

⚠️ Warnings (1): Fix when the suggestion improves clarity or correctness.

File	Line	Rule	Message
deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md	131	Elastic.DontUse	Don't use 'just'. Choose a more precise or reader-focused term.

💡 Suggestions (1): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
deploy-manage/monitor/stack-monitoring/ece-ech-stack-monitoring.md	112	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.