Switch default logs template to search all fields by default

[eyalkoren]

Closes #99872

Added a test that would fail prior to this change.
This adds the risk of hitting the maxClauseLimit error, so a fix for #102378 should follow up

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)

[elasticsearchmachine]

Hi @eyalkoren, I've created a changelog YAML for you.

[eyalkoren]

@elasticmachine run elasticsearch-ci/docs

[ruflin]

The code change LGTM.

I suggest we also have some docs ready around this that

1. describes the behaviour when searching on logs-- form 8.x on
2. describes how the behaviours could be changed by to message only by using logs@custom or similar

[ruflin]

@mdbirnstiehl Can you help us on where these docs would fit in?

EDIT BY @eyalkoren: not sure if we need to doc that the default_field had changed, because it wasn't documented before.
However, what we do want to document for sure is that there is a way to set the default_field to explicit field/s through the logs@custom component template, as demonstrated in the added test.
Maybe it can go into the Logs troubleshooting page if the maxClauseLimit occurs.
I think we generally miss documentation about the @custom components.

[mdbirnstiehl]

@ruflin @eyalkoren We don't really document anything about specific component templates or default index templates aside from the fact that they exist (aside from some small blurbs in the "Parse logs" doc. Adding something about maxClauseLimit and changing the default_field to the troubleshooting could be a short term solution, but it seems like long-term there should be a reference section in the logs docs that explains the templates available to our users and how they can use them. Maybe starting with logs@custom?

[ruflin]

long-term there should be a reference section in the logs docs that explains the templates available to our users and how they can use them. Maybe starting with logs@custom?

Agree. Can you follow up with an issue. +1 on starting with logs@custom. Please also have a chat with the docs members from the ingest team as they might already have bits on this or you can collaborate.

[felixbarny]

Here are some places in our docs that mention *@custom component templates and pipelines: https://github.com/search?q=org%3Aelastic+%40custom+language%3AAsciiDoc&type=code&l=AsciiDoc

[mdbirnstiehl]

Sounds good, I'll create an issue, check out the current @custom mentions, and reach out to the ingest team.