Replace read_timestamp with event.created in all remaining Filebeat modules

[webmat]

Note that some of the recent module migrations have already started populating event.created instead of read_timestamp. This PR does the remaining modules all at once.

Modules/filesets affected:

• iis.error
• kafka
• kibana
• nginx.access
• osquery
• redis
• traefik.access

Outside of these modules, the only occurrences I see of read_timestamp are the field definitions and test_modules.py.

So this PR will alias read_timestamp to event.created as well.

I've taken the opportunity to put in place the alias for Journalbeat as well. Didn't look like it was being used there anymore.

[webmat]

Test failures are related:

{"type":"mapper_parsing_exception","reason":"failed to parse","caused_by":{"type":"illegal_argument_exception","reason":"Cannot write to a field alias [read_timestamp]."}}

For Kibana, Redis and Kafka

[webmat]

@ycombinator In migrating read_timestamp to event.created, I noticed that the Kibana pipeline wasn't using the field correctly. This field is meant to contain the time at which the Beat first saw the event, not the timestamp contained in the event from upstream.

[ycombinator]

Thanks for fixing up the Kibana pipeline, @webmat! Would it be worth adding a special mention about this breaking change in the CHANGELOG?

[webmat]

@ycombinator Oh yes, good point. I've done that. Hopefully not too verbose.