[RFC] match_only_text type migration - Stage 1

[ebeahan]

Summary

Continuing onto Stage 1 proposal for migrating text type fields, including the message base field, to use the match_only_text data type being introduced in Elasticsearch 7.14.

Stage 1 (Draft) Criteria:

• Opened pull request for this proposal revising the existing strawperson
• Identified "sponsor" at Elastic who will participate in RFC process and take ownership of the change after the process completes
• Outlined initial field definitions
• High-level description of examples of usage
• High-level description of example sources of data
• Identified potential concerns and implementation challenges/complexity
• Subject matter experts identified and weighed in on the high level utility of these changes in the pull request
• ECS team weighed in on appropriateness of these changes in the pull request
• Assess potential performance impact

Preview of markdown proposal

[ebeahan]

Notable changes for stage 1:

• I've extended the proposal also to include the current text multi-fields. I am happy to discuss more here if there are concerns or feedback, but I think we should pursue migrating to match_only_text across all of ECS as a replacement for text. For the majority of ECS use cases, users would likely benefit from the reduced storage use and not be impacted by the limitations of `match_only_text
• Listed the ECS team has a sponsor here. Since this would be a broad change across various field sets, I think it makes sense for ECS to sponsor the proposal. Again, open to discussion.
• Added detail to the Scope of Impact, Source data, and Concerns sections.

I'd appreciate it if reviewers would review and comment on:

• The list of candidate fields to migrate. Concerns with migrating all text fields?
• Any concerns with ECS team self-sponsoring?
• Any missing concerns or considerations?

[jpountz]

👍

[djptek]

Suggest to add actionable item for performance impact analysis on both the two original fields as well as the 49 multi-fields added in Stage 1

[djptek]

sent a merge so the checks would pass

[ebeahan]

After some out-of-band discussion on performance testing these changes, I'm removing the .text multi-fields from this RFC. This will narrow the scope of the proposed change to two text fields: message and error.message.

Migrating the .text multi-fields will be proposed in a future RFC (and perhaps multiple future RFCs).

[djptek]

LGTM

[ebeahan]

Holding off on merging until potential performance impact is assessed.