Rename _audit.log to _audit.json

[pgomulka]

As a follow up from discussion comment
in order to keep json logs consistent the security aduit logs are renamed from .log to .json

relates #32850

[elasticmachine]

Pinging @elastic/es-core-infra

[elasticmachine]

Pinging @elastic/es-security

[albertzaharovits]

@ycombinator what do you think, is this necessary for consistency from the ingest perspective?
It's not clear for me from #32850 (comment) that it is.

[ycombinator]

Strictly speaking, it's not necessary from an Ingest perspective as Filebeat can uniquely target audit.log as the new, JSON-formatted audit log file. However, from a consistency perspective, it would definitely be very nice if all Elasticsearch logs that emitted JSON entries had .json as their extension. So I'm +1 for this change.

[albertzaharovits]

Understood, thank you @ycombinator for the input!

[albertzaharovits]

Thank you for tackling this one too @pgomulka !

I am OK with the change. I vaguely remember some qa sql tests parsing the audit log so you might encounter some CI failures. In addition I think a breaking change notice is in order. I am not quite sure where to file it, but maybe @lcawl can help? I am thinking, docs/reference/migration/migrate_7_0/cluster.asciidoc.

[albertzaharovits]

LGTM

[pgomulka]

@elasticmachine run elasticsearch-ci/2

[pgomulka]

@elasticmachine run elasticsearch-ci/1

[pgomulka]

@elasticmachine run elasticsearch-ci/docs-check