[RFC] Multiple Users - Update to align with new proposal stages

[ebeahan]

Update the multiple users RFC proposal's stage to align with new RFC proposal stages.

[epixa]

For multi-user, what items remain before we can consider stage 3?

[ebeahan]

The stage 3 criteria (minus the PR step):

• Included multiple real-world example source documents
• Existing or newly raised questions and concerns are addressed
• No objections from the sponsor, ECS team, or subject matter experts

I feel the proposal doc itself is complete, with several examples and all captured concerns having a documented resolution. The only outstanding item I see is an agreement that the fields as defined are complete. I don't expect any objections to arise, though.

Implementation of ECS 1.8 is ongoing (e.g., elastic/beats#23118) without any major hurdles AFAIK. The multiple user changes are being released as beta in 1.8, giving us some flexibility if any adjustments become needed.

[ebeahan]

After more discussion out-of-band, the ECS team feels comfortable and confident considering the multiple users RFC as finished.

@adriansr @marc-gr, you both have been doing most of the ECS 1.8 implementation work in beats/integrations (elastic/beats#23118) to adopt the multiple users' fields. Any issues or feedback you have from that work that should be captured before considering the multiple users RFC finished?

[adriansr]

@ebeahan I can't think of any issue that could prevent the RFC to be finished.

Only issue that I remember is not being able to map some events that modify multiple users at the same time, understandable as related can't be an array.

And at some point we should give some thought to similar changes for group.* fields.

[ebeahan]

From the feedback, sounds like we're all in agreement to consider this RFC finished. 🎉

I've updated the proposal to reflect that change. Once this is merged, I'll open a separate PR to remove the beta attribute from these fields in the schema.

[ebeahan]

@epixa Would you give this one final look?

[epixa]

LGTM