Enhancing the `logs-*-*` index template with a default ingest pipeline that is first doing a pre-flight check if the `message` field might be JSON and then uses the JSON processor to decode the JSON and merge it top-level with the document.

See also this prototype: https://gist.github.com/felixbarny/a9a2f6243153d5508643fd95ac968a88#file-routing-yml-L114-L174

Open questions and things to consider
* How do users opt-out of default JSON parsing? They could override the index template. Maybe that's good enough.
* Similarly to the logs@custom component template, should we call out to a custom index pipeline? Align with naming in Fleet.
x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java
StackRegistryWithNonRequiredTemplates registryWithNonRequiredTemplate = new StackRegistryWithNonRequiredTemplates(
            Settings.EMPTY,
            clusterService,
            threadPool,
            client,
            NamedXContentRegistry.EMPTY
        );
        DiscoveryNode node = TestDiscoveryNode.create("node");
        DiscoveryNodes nodes = DiscoveryNodes.builder().localNodeId("node").masterNodeId("node").add(node).build();
        ClusterChangedEvent event = createClusterChangedEvent(
            Collections.singletonMap(StackTemplateRegistry.LOGS_SETTINGS_COMPONENT_TEMPLATE_NAME, null),
            nodes
        );
        final AtomicInteger calledTimes = new AtomicInteger(0);
        client.setVerifier((action, request, listener) -> {
            if (action instanceof PutComponentTemplateAction) {
                
                return AcknowledgedResponse.TRUE;
            } else if (action instanceof PutLifecycleAction) {
                
                return AcknowledgedResponse.TRUE;
            } else if (action instanceof PutComposableIndexTemplateAction) {
                calledTimes.incrementAndGet();
                assertThat(request, instanceOf(PutComposableIndexTemplateAction.Request.class));
                PutComposableIndexTemplateAction.Request putComposableTemplateRequest = (PutComposableIndexTemplateAction.Request) request;
                assertThat(putComposableTemplateRequest.name(), equalTo("syslog"));
                ComposableIndexTemplate composableIndexTemplate = putComposableTemplateRequest.indexTemplate();
                assertThat(composableIndexTemplate.composedOf(), hasSize(2));
                assertThat(composableIndexTemplate.composedOf().get(0), equalTo("logs-settings"));
                assertThat(composableIndexTemplate.composedOf().get(1), equalTo("syslog@custom"));