Update the Logstash output doc with guidance on using a single ES output

[vishaangelova]

Summary

This PR adds a Use a single Elasticsearch output section documenting an alternative to the dual-output example in the Fleet Logstash output doc.

Closes #7854

Verification

Used Claude to check against logstash-plugins/logstash-output-elasticsearch at HEAD:

• data_stream_event_action_tuple calls the same common_event_params, which reads [@metadata][_ingest_document], so this works with data_stream => true.
• The behavior landed in Elasticsearch output plugin 11.21.0; Logstash 8.12.0 is the first release that bundles it.
• resolve_document_id prefers an explicit document_id, so the two must not be combined. Documented as a caveat.
• The elastic_integration filter replaces the whole [@metadata][_ingest_document] map via event.setField, so the mutate must come after it. Also documented.

Reviewer note

[@metadata][_ingest_document][id] is documented as an output of the elastic_integration filter, but the Elasticsearch output plugin's docs never mention that it consumes the field. Documenting it here makes an internal contract semi-public, so I'd like a Logstash maintainer (cc @robbavey, per the issue) to confirm this is acceptable before merge.

A follow-up PR will apply the same treatment to docs/reference/filebeat/filebeat-deduplication.md in elastic/beats, which carries the identical dual-output pattern.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes
• No

Tool(s) and model(s) used: Cursor (Claude Opus 5)

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• reference/fleet/logstash-output.md

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.