[Filebeat] List of text fields to be converted

[ruflin]

This PR is for discussing the current text fields in Filebeat and if the type should be changed.

[webmat]

You've turned up a lot of things, good stuff!

I think when in doubt, we should always go for keyword indexing at the canonical field (or go for non-indexed if really it doesn't make sense to index); and leave users or future us add .text later on, when needed. This new convention reduces chances of breaking changes a lot, for all fields where we adopt it.

Tried to respond to everything below :-)

[ycombinator]

Probably a question for @ruflin:

In many ECS conversion PRs we say we want to treat a field as keyword for now and later, if necessary, add a text ES multi-field to it. I like this idea a lot. But I'm curious if this is possible today in Filebeat. Concretely, is it possible to specify in fields.yml today a field as a keyword and also specify that it should have a text multi-field, and will that result in the right ES template mapping?

[ruflin]

@ycombinator Yes:

  fields:
    - name: multifield_field
      type: keyword
      multi_fields:
        - name: foo
          type: text

[ruflin]

@ycombinator Could you tackle the Stack modules changes?

[ruflin]

I opened PR for all changes except the Elastic Stack. @ycombinator Can you ping here as soon as you have 1 (or multiple PR's) open for the fields so I can close this PR here?

[ycombinator]

@ruflin will do, it's item 5 on my TODO list for today so will probably get to it in a couple hours unless other stuff pops up (which never happens, of course).

[ycombinator]

@ruflin @webmat I've opened 2 PRs for the stack module changes:

• elasticsearch module changes: [Filebeat] Changes to text fields in elasticsearch module #10414
• logstash module changes: [Filebeat] Changes to text fields in logstash module #10417

[ruflin]

Thanks @ycombinator

Closing this PR as all changes have been addressed in follow up PR's.