Enhancing the `logs-*-*` index template with a default ingest pipeline that is first doing a pre-flight check if the `message` field might be JSON and then uses the JSON processor to decode the JSON and merge it top-level with the document.

See also this prototype: https://gist.github.com/felixbarny/a9a2f6243153d5508643fd95ac968a88#file-routing-yml-L114-L174

Open questions and things to consider
* How do users opt-out of default JSON parsing? They could override the index template. Maybe that's good enough.
* Similarly to the logs@custom component template, should we call out to a custom index pipeline? Align with naming in Fleet.
x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java
assertThat(request, instanceOf(PutLifecycleAction.Request.class));
                final PutLifecycleAction.Request putRequest = (PutLifecycleAction.Request) request;
                assertThat(
                    putRequest.getPolicy().getName(),
                    anyOf(
                        equalTo(StackTemplateRegistry.LOGS_ILM_POLICY_NAME),
                        equalTo(StackTemplateRegistry.METRICS_ILM_POLICY_NAME),
                        equalTo(StackTemplateRegistry.SYNTHETICS_ILM_POLICY_NAME),
                        equalTo(StackTemplateRegistry.ILM_7_DAYS_POLICY_NAME),
                        equalTo(StackTemplateRegistry.ILM_30_DAYS_POLICY_NAME),
                        equalTo(StackTemplateRegistry.ILM_90_DAYS_POLICY_NAME),
                        equalTo(StackTemplateRegistry.ILM_180_DAYS_POLICY_NAME),
                        equalTo(StackTemplateRegistry.ILM_365_DAYS_POLICY_NAME)
                    )
                );
                assertNotNull(listener);
                return AcknowledgedResponse.TRUE;
            } else if (action instanceof PutComponentTemplateAction) {
                
                return new StackTemplateRegistryTests.TestPutIndexTemplateResponse(true);
            } else if (action instanceof PutComposableIndexTemplateAction) {
                
                return AcknowledgedResponse.TRUE;
            } else {
                fail("client called with unexpected request: " + request.toString());
                return null;
            }
        });
        ClusterChangedEvent event = createClusterChangedEvent(Collections.emptyMap(), nodes);
        registry.clusterChanged(event);