add Kibana version to eventLog ECS log entries

[pmuellr]

I realized we probably want the Kibana version added to the eventLog ECS log entries. Will probably need to go in the top-level custom kibana object property.

There may be a few other bits we want in there as well. Should poke around what other Kibana-specific properties are available, to see if we want it added.

[elasticmachine]

Pinging @elastic/kibana-alerting-services (Team:Alerting Services)

[pmuellr]

I think this can be a constant keyword field.

[YulNaumenko]

Related PR

[pmuellr]

going to remove and re-add this issue to the alerting project, so it will be re-triaged; we recently chatted about this, and realized we'll want this in by 8.0, and maybe earlier, to help with versions-specific queries when the saved object id's change for share-ability

[mikecote]

we may want to keep major, minor, and patch separate fields to support querying ex: "< 8.0"

[pmuellr]

Yes, if we end up going with constant keyword fields, it would be useful to make the pieces separately available, though I was thinking this:

• version: 7.15.0
• versionMajorMinor: 7.15
• versionMajor: 7

Seems highly likely that we'd be making use of versionMajorMinor, since we usually don't change shapes in patch releases, and having them as separate fields will be a bit slower. Maybe? Maybe not, if they're constant keyword ... good question to ask elasticsearch folk ...

[mikecote]

@pmuellr my main concern with versionMajorMinor is you cannot do a range query on it to determine if 7.15 is < than 7.16. Compared to major <= 7 and minor <= 15.

[pmuellr]

good point! you win :-)

[pmuellr]

Wanted to note that RAC is probably going to be adding a Kibana version field as well - but they might not right now, since it technically wouldn't be needed for the "first release" (you can check that version by lack of the field). So we probably want to wait till that's settled, so we use the same field name.

[mikecote]

Marking as blocked to give time to align with the approach for alert data indices.

[mikecote]

I came across this as well as an option: https://www.elastic.co/guide/en/elasticsearch/reference/master/version.html