Originally posted in elastic/integrations#3451 (comment)

Add a new validation rule to ensure that if there is a rename processor whose target_field is event.original and field is message, it needs also to check that if key is defined checking about the presence of event.original in the document.

Moreover this new validation rule needs to check that a remove processor is defined to remove the message field, to avoid duplication.

As an example, if there is that rename processor in the ingest pipeline, a remove processor should exist and that rename processor should be like :

    - rename:
        field: message
        target_field: event.original
        # ignore_missing: true 
        if: 'ctx.event?.original == null'
    - remove:
        field: message
        ignore_missing: true
        if: 'ctx.event?.original != null'

Similar to what it was done in elastic/integrations#7026