https://github.com/elastic/ecs/pull/426 added hash.* fields but "user" already contains hash. So user.hash should become user.hash.*.
#426 added hash.* fields but "user" already contains hash. So user.hash should become user.hash.*.