Don't expect aliases in output dictionaries

[jsoriano]

With the creation of aliases for ECS we have found that some features
weren't being migrated and were writing to aliases (like in #10757).
Consider writing to an alias field like writing to an undocumented field.

[jsoriano]

Failing tests will pass once #10927 is merged, will rebase then.

[sayden]

Code seems ok although I'm not really sure about how to test it

[jsoriano]

@sayden you can test it by writing from a module to a field documented as alias, and running the system tests for this module. For example if you revert #10927 and run test_docker.py you will see that docker module was creating events with docker.container.* fields, that are now defined as aliases to container.*.

I can wait to merge this if you want to give it a try.

[sayden]

I don't want to block this PR. Just wanted to give you some help trying a local test.