Move message fields to match_only_text

[jpountz]

7.14 is introducing a new field type called match_only_text which is meant as a more space-efficient variant of the text field type. Its only downsides are the following:

• no support for scoring: queries ignore index statistics and produce constant scores,
• span queries are unsupported,
• phrase and intervals queries run slower.

Other than that, this field supports the same feature set as text, and like text it doesn't support aggregations. See https://www.elastic.co/guide/en/elasticsearch/reference/master/text.html#match-only-text-field-type if you would like to know more.

We are in the process of changing our built-in templates in Elasticsearch so that message fields get mapped as match_only_text rather than text. I think we should do the same in ECS as of Elasticsearch 7.14 (when this field gets released)?

Please let me know if there's anything I can do to help.

[ebeahan]

Thanks, @jpountz! We had been excitedly following the progress of match_only_text to see where we could adopt it once it was ready. 😄

I agree with looking to update message in ECS as well, and I think we may even consider additional fields within ECS where it makes sense.

[djptek]

@jpountz we'll aim to open an RFC to move this forward, watch this space

[ebeahan]

Stage 0 RFC PR: #1396

[ebeahan]

Stage 1 RFC PR: #1415

[ebeahan]

RFC 0023 is finished and the changes implemented in #1584

[jpountz]

Thank you @ebeahan for moving this forward!