[Question] Default agent

**ECS integration/library project(s) (e.g. Elastic.CommonSchema.Serilog)**: all logging framework integrations, 8.6.1

Hi, I wanted to ask, what is the goal of [`DefaultAgent`](https://github.com/elastic/ecs-dotnet/blob/eac06c3df532d33c1889cca7dca388216c945dc4/src/Elastic.CommonSchema.Serilog/LogEventConverter.cs#L18)? When I read description of [`agent`](https://www.elastic.co/guide/en/ecs/8.6/ecs-agent.html) field, it doesn't sound to me like `Elastic.CommonSchema.*` package is an agent.

Problem is that when log are later shipped by Filebeat, it adds some of its values, and whole `agent.*` field looks like a mixture of different values from different sources:

These fields look consistent like when log entries in the file originally do not have `agent.*` fields:

(It might be also the question that is worth asking Filebeat devs why not all fields get overwritten by Filebeat, upd: https://discuss.elastic.co/t/filebeat-7-17-6-does-not-overwrite-agent-type-and-agent-version-if-they-are-already-present/344521)

P.S. Sorry for the wrong label, Github suggests only templates for bugs and features.

Start with src/Elastic.CommonSchema.Serilog/LogEventConverter.cs at DefaultAgent and compare its purpose with the ECS agent field documentation linked in the issue. Reproduce how Filebeat merges the existing agent.* fields, then review the linked Filebeat discussion. Done means clarifying which component should own these fields and documenting or resolving the integration behavior.

Written by the indexing model from the issue text.