Enable default fields for Elasticsearch 6.x

[ruflin]

Previously default_fields were only enabled for Elasticsearch 7.x. For the migration it is required that also indices from Elasticsearch 6.x have the default_field option set. This enables it for 6.x except 6.0.

Closes #11187

[ruflin]

I tried to find a good reason on why we enabled this only for 7.0 and not 6.x. The initial PR was done here: #7015 It could be argued that it's a breaking change as non keyword / ip fields which were directly searchable before are not searchable anymore. I "assume" before you could have typed just 42 and it would have returned all fields with the value 42. This is now not possible anymore but from my perspective an ok tradeoff for this migration case.

[ruflin]

I tested this against 6.6 and it works as expected. If I run this against 6.0 I get the following error:

2019-03-12T08:37:10.161+0100    ERROR   pipeline/output.go:100  Failed to connect to backoff(elasticsearch(http://localhost:9200)): Connection marked as failed because the onConnect callback failed: Error loading Elasticsearch template: could not load template. Elasticsearch returned: couldn't load template: couldn't load json. Error: 400 Bad Request: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"unknown setting [index.query.default_field.0] did you mean [index.query.default_field]?"}],"type":"illegal_argument_exception","reason":"unknown setting [index.query.default_field.0] did you mean [index.query.default_field]?"},"status":400}. Response body: {"error":{"root_cause":[{"type":"illegal_argument_exception","reason":"unknown setting [index.query.default_field.0] did you mean [index.query.default_field]?"}],"type":"illegal_argument_exception","reason":"unknown setting [index.query.default_field.0] did you mean [index.query.default_field]?"},"status":400}.

I think the change was applied here: elastic/elasticsearch#26320 In 6.0 default_field did not accept an array yet. To keep 6.7 compatible with 6.0 I will exclude 6.0 from setting the default_field. For the migration, we should recommend users to be on 6.7 first anyways.

Limit to 6.7 version only?

[urso]

This enables it for all 6.x ES versions. Would it be better if we check the minor version as well?

ver.Major >= 7 || (ver.Major ==6 && ver.Minor >= 7)

[ruflin]

Should have pushed by local changes. My take at the moment is that it should set it for 6.x versions except 6.0.

[ph]

@urso Targetting 6.x look a good idea to me, following @joshdover this option exist since 5.6