[Bug][ECS 1.7] Missing dns.answers fields in experimental schema

[andrewstucki]

Description of the issue:

Compare

ecs/experimental/generated/beats/fields.ecs.yml

Lines 969 to 970 in 6cbb544

	fields:
	- name: answers.class

With

ecs/generated/beats/fields.ecs.yml

Lines 986 to 987 in 6cbb544

	fields:
	- name: answers

The first is for the experimental fields, the second is for the standard fields. Looks like the experimental (accidentally?) drops dns.answers -- not sure if there are any other fields like this -- but this one was caught by packetbeat integration tests.

[ebeahan]

The dns.answer object contains intermediate: True when the dns.answer.data object is loaded and the deeply nested structure is generated. When working properly, it sets intermediate: False. I'm still assessing the best way to handle this case in the code.

This isn't unique to the experimental schema. Any custom definitions modifying dns.answers.* will reproduce this behavior.

A workaround is to define answer with type object in the experimental definitions:

---
- name: dns
  fields:
    - name: question.name
      type: wildcard
    - name: answers
      type: object
    - name: answers.data
      type: wildcard

[webmat]

I'd be fine if we did that as a temporary fix for the release. We can keep this issue opened to fix fully later, without the rush :-)

[ebeahan]

Temporary workaround added in #1118

[djptek]

@ebeahan working on this