Fix ndjson parser to store JSON fields correctly under target

[zipperle]

What does this PR do?

Stores the JSON fields in a nested way if the target of the ndjson parser contains a dotted key, e.g.

the following config:

parsers:
- ndjson:
    add_error_key: true
    target: kubernetes.audit

leads to this result:

"kubernetes": {
   "audit": {
      "userAgent": ...,

instead of this:

"kubernetes.audit": {
   "userAgent": ...
    ...
}

Why is it important?

Fixes unexpected behavior.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

Tested with a unit test.

Related issues

• Closes ndjson parser: json fields are stored not correctly under target  #29395

Use cases

Screenshots

Logs

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @zipperle? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-07-20T12:26:20.353+0000

• Duration: 69 min 15 sec

Test stats 🧪

Test	Results
Failed	0
Passed	27537
Skipped	2029
Total	29566

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/elastic-agent (Team:Elastic-Agent)

[ycombinator]

/test

[ycombinator]

/test

[ycombinator]

@zipperle Left a minor comment about the CHANGELOG entry. Also, I rebased this PR on main a couple of times, so you'll want to pull down the PR's branch from your remote first before making any further changes.

[zipperle]

@ycombinator thanks for the hint, I moved the changelog entry accordingly.

[ycombinator]

/test

[ycombinator]

/test

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b main upstream/main
git merge upstream/main
git push upstream main

[ycombinator]

/test

[ycombinator]

LGTM. Thanks for the contribution, @zipperle!