Remove guidance to lowercase http.request.method

CHANGELOG.next.md

@@ -33,6 +33,7 @@ Thanks, you're awesome :-) -->
 
 #### Deprecated
 
+* Deprecate guidance to lowercase `http.request.method` #840
 
 ### Tooling and Artifact Changes
 

docs/field-details.asciidoc

@@ -2824,13 +2824,17 @@ example: `1437`
 | http.request.method
 | HTTP request method.
 
-The field value must be normalized to lowercase for querying. See the documentation section "Implementing ECS".
+Prior to ECS 1.6.0 the following guidance was provided:
+
+"The field value must be normalized to lowercase for querying."
+
+As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection.  Original case will be mandated in ECS 2.0.0
 
 type: keyword
 
 
 
-example: `get, post, put`
+example: `GET, POST, PUT, PoST`
 
 | extended
 

generated/beats/fields.ecs.yml

@@ -2273,9 +2273,14 @@
       ignore_above: 1024
       description: 'HTTP request method.
 
-        The field value must be normalized to lowercase for querying. See the documentation
-        section "Implementing ECS".'
-      example: get, post, put
+        Prior to ECS 1.6.0 the following guidance was provided:
+
+        "The field value must be normalized to lowercase for querying."
+
+        As of ECS 1.6.0, the guidance is deprecated because the original case of the
+        method may be useful in anomaly detection.  Original case will be mandated
+        in ECS 2.0.0'
+      example: GET, POST, PUT, PoST
     - name: request.referrer
       level: extended
       type: keyword

generated/csv/fields.csv

@@ -264,7 +264,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 1.6.0-dev,true,http,http.request.body.content,keyword,extended,,Hello world,The full HTTP request body.
 1.6.0-dev,true,http,http.request.body.content.text,text,extended,,Hello world,The full HTTP request body.
 1.6.0-dev,true,http,http.request.bytes,long,extended,,1437,Total size in bytes of the request (body and headers).
-1.6.0-dev,true,http,http.request.method,keyword,extended,,"get, post, put",HTTP request method.
+1.6.0-dev,true,http,http.request.method,keyword,extended,,"GET, POST, PUT, PoST",HTTP request method.
 1.6.0-dev,true,http,http.request.referrer,keyword,extended,,https://blog.example.com/,Referrer for this HTTP request.
 1.6.0-dev,true,http,http.response.body.bytes,long,extended,,887,Size in bytes of the response body.
 1.6.0-dev,true,http,http.response.body.content,keyword,extended,,Hello world,The full HTTP response body.

generated/ecs/ecs_flat.yml

@@ -3632,9 +3632,13 @@ http.request.method:
   dashed_name: http-request-method
   description: 'HTTP request method.
 
-    The field value must be normalized to lowercase for querying. See the documentation
-    section "Implementing ECS".'
-  example: get, post, put
+    Prior to ECS 1.6.0 the following guidance was provided:
+
+    "The field value must be normalized to lowercase for querying."
+
+    As of ECS 1.6.0, the guidance is deprecated because the original case of the method
+    may be useful in anomaly detection.  Original case will be mandated in ECS 2.0.0'
+  example: GET, POST, PUT, PoST
   flat_name: http.request.method
   ignore_above: 1024
   level: extended

generated/ecs/ecs_nested.yml

@@ -4236,9 +4236,14 @@ http:
       dashed_name: http-request-method
       description: 'HTTP request method.
 
-        The field value must be normalized to lowercase for querying. See the documentation
-        section "Implementing ECS".'
-      example: get, post, put
+        Prior to ECS 1.6.0 the following guidance was provided:
+
+        "The field value must be normalized to lowercase for querying."
+
+        As of ECS 1.6.0, the guidance is deprecated because the original case of the
+        method may be useful in anomaly detection.  Original case will be mandated
+        in ECS 2.0.0'
+      example: GET, POST, PUT, PoST
       flat_name: http.request.method
       ignore_above: 1024
       level: extended

schemas/http.yml

@@ -15,9 +15,16 @@
       description: >
         HTTP request method.
 
-        The field value must be normalized to lowercase for querying. See
-        the documentation section "Implementing ECS".
-      example: get, post, put
+        Prior to ECS 1.6.0 the following guidance was provided:
+
+        "The field value must be normalized to lowercase for
+        querying."
+
+        As of ECS 1.6.0, the guidance is deprecated because the
+        original case of the method may be useful in anomaly
+        detection.  Original case will be mandated in ECS 2.0.0
+
+      example: GET, POST, PUT, PoST
 
     - name: request.body.content
       level: extended