[9.2 forward port] Add entity to the top level namespaces in which it's being used (#2556)

docs/reference/ecs-cloud.md

@@ -41,9 +41,9 @@ Note also that the `cloud` fields may be used directly at the root of the events
 
 | Location | Field Set | Description |
 | --- | --- | --- |
+| `cloud.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |
 | `cloud.origin.*` | [cloud](/reference/ecs-cloud.md) | Provides the cloud information of the origin entity in case of an incoming request or event. |
 | `cloud.target.*` | [cloud](/reference/ecs-cloud.md) | Provides the cloud information of the target entity in case of an outgoing request or event. |
-| `cloud.target.entity.*` | [entity](/reference/ecs-entity.md) | Entity information for the target cloud entity. |
 
 ### Cloud field usage [_cloud_field_usage]
 

docs/reference/ecs-entity.md

@@ -33,9 +33,10 @@ The entity fields provide a standardized way to represent and categorize differe
 
 The `entity` fields are expected to be nested at:
 
-* `cloud.target.entity`
+* `cloud.entity`
 * `host.entity`
-* `service.target.entity`
-* `user.target.entity`
+* `orchestrator.entity`
+* `service.entity`
+* `user.entity`
 
 Note also that the `entity` fields are not expected to be used directly at the root of the events.

docs/reference/ecs-orchestrator.md

@@ -32,3 +32,8 @@ Fields that describe the resources which container orchestrators manage or act u
 | $$$field-orchestrator-type$$$ [orchestrator.type](#field-orchestrator-type) | Orchestrator cluster type (e.g. kubernetes, nomad or cloudfoundry).<br><br>type: keyword<br><br>example: `kubernetes` | extended |
 
 
+### Field sets that can be nested under Orchestrator [ecs-orchestrator-nestings]
+
+| Location | Field Set | Description |
+| --- | --- | --- |
+| `orchestrator.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |

docs/reference/ecs-service.md

@@ -43,9 +43,9 @@ Note also that the `service` fields may be used directly at the root of the even
 
 | Location | Field Set | Description |
 | --- | --- | --- |
+| `service.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |
 | `service.origin.*` | [service](/reference/ecs-service.md) | _Reusing the `service` fields in this location is currently considered beta._ Describes the origin service in case of an incoming request or event. |
 | `service.target.*` | [service](/reference/ecs-service.md) | _Reusing the `service` fields in this location is currently considered beta._ Describes the target service in case of an outgoing request or event. |
-| `service.target.entity.*` | [entity](/reference/ecs-entity.md) | Entity information for the target service. |
 
 ### Service field usage [_service_field_usage]
 

docs/reference/ecs-user.md

@@ -50,10 +50,10 @@ Note also that the `user` fields may be used directly at the root of the events.
 | --- | --- | --- |
 | `user.changes.*` | [user](/reference/ecs-user.md) | Captures changes made to a user. |
 | `user.effective.*` | [user](/reference/ecs-user.md) | User whose privileges were assumed. |
+| `user.entity.*` | [entity](/reference/ecs-entity.md) | Fields to describe various types of entities across IT environments. |
 | `user.group.*` | [group](/reference/ecs-group.md) | User's group relevant to the event. |
 | `user.risk.*` | [risk](/reference/ecs-risk.md) | Fields for describing risk score and level. |
 | `user.target.*` | [user](/reference/ecs-user.md) | Targeted user of action taken. |
-| `user.target.entity.*` | [entity](/reference/ecs-entity.md) | Entity information for the targeted user. |
 
 ### User field usage [_user_field_usage]