Clarify url.query usage to specify full query string format

[johnmschoonover]

This update removes ambiguity around the url.query field by explicitly stating that it should contain the full query string, including compound parameters.

An example with multiple query parameters is added to reinforce this guidance. This helps prevent misinterpretation—such as splitting the query into an array of keywords—and promotes consistent, ECS-compliant implementations across ingestion pipelines and tools.

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process?
• If submitting code/script changes, have you verified all tests pass locally using make test?
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes?
• Is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed.
• Have you added an entry to the CHANGELOG.next.md?

[github-actions]

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[cla-checker-service]

💚 CLA has been signed

[johnmschoonover]

run docs-build