The [updated spec](https://github.com/elastic/ecs-logging-python/pull/87) expects `ecs.version` to be dotted, not nested, to match `log.level`.