Merged elastic#1171 changes, which touched some of the same code:

- merged the new mechanism of using the oss fallback for 6.x
- kept my rename to a shorter variable name 'es_version'

CHANGELOG.next.md

@@ -18,18 +18,26 @@ Thanks, you're awesome :-) -->
 
 * Added `event.category` "registry". #1040
 * Added `event.category` "session". #1049
+* Added usage documentation for `user` fields. #1066
+* Added `user` fields at `user.effective.*`, `user.target.*` and `user.changes.*`. #1066
 * Added `os.type`. #1111
 
 #### Improvements
 
+* Note `[` and `]` bracket characters may enclose a literal IPv6 address when populating `url.domain`. #1131
+
 #### Deprecated
 
+* Deprecated `host.user.*` fields for removal at the next major. #1066
+
 ### Tooling and Artifact Changes
 
 #### Breaking changes
 
 #### Bugfixes
 
+* `tracing` fields should be at root of Beats `fields.ecs.yml` artifacts. #1164
+
 #### Added
 
 * Added ability to supply free-form usage documentation per fieldset. #988
@@ -43,6 +51,10 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+* Added a notice highlighting that the `tracing` fields are not nested under the
+  namespace `tracing.` #1162
+* ES 6.x template data types will fallback to supported types. #1171
+
 #### Deprecated