Allow multiple field names/patterns for (path_)(un)match

[EmilBode]

Use Case
I'd like to have a dynamic mapping, for different fields, that can't all be described in one pattern.
The most straightforward way of doing so would be to provide an array of fieldnames to the match-argument in a dynamic template, see the example.

And if we're going to change this, I think it would be logical to do the same for unmatch and path_match/path_unmatch

Desired behaviour
I'd like to be be able to specify:

PUT testindex
{
  "mappings": {
    "dynamic_templates": [
      {
        "test": {
          "match": ["one*", "*two"],
          "mapping": {
            "type": "keyword"
          }
        }
      }
    ]
  }
}

PUT testindex/_doc/1
{
  "one_test": "eentje",
  "test_two": "twee",
  "three": "drie"
}

And have the resulting mappings for testindex :

"properties" : {
  "test_two" : {
    "type" : "keyword"
  },
  "three" : {
    "type" : "text",
    "fields" : {
      "keyword" : {
        "type" : "keyword",
        "ignore_above" : 256
      }
    }
  },
  "one_test" : {
    "type" : "keyword"
  }
}

Current behaviour
Right now, the dynamic template is ignored. Under water, the array is converted to a string-representation, so the dynamic template actually becomes

[
  {
    "test": {
      "match": "[one*, *two]",
      "mapping": {
        "type": "keyword"
      }
    }
  }
]

Which will, of course, not match on any of my fields.

Workaround
It is of course possible to specify each pattern seperately, like below, but this gets large when there are more patterns.
Alternatively, a regex could match all field names (^one.*|.*two$), but this get also get cumbersome.

PUT testindex
{
  "mappings": {
    "dynamic_templates": [
      {
        "test": {
          "match": "one*",
          "mapping": {
            "type": "keyword"
          }
        }
      },
      {
        "test": {
          "match": "*two",
          "mapping": {
            "type": "keyword"
          }
        }
      }
    ]
  }
}

[elasticmachine]

Pinging @elastic/es-search (Team:Search)

[shaigbdb]

I got here looking for a solution for the "unmatch" scenario, that is the pattern should match everything besides two or more patterns.
The workaround I found for this is based on the one by @EmilBode . This matches everything besides fields starting with one_ or two_ .

    "dynamic_templates": [


            {
              "other_dynamic": {
                "mapping": {
                  "enabled": false,
                  "type": "object"
                },
                "match": "^(?!(one_|two_)).+$",
                  "match_pattern": "regex"
              }
            }
    ]

[ruflin]

Would be great to get this moving in the context of elastic/integrations#5055. Here the specific can be found: elastic/elastic-package#1093 Having support for arrays on match and patch_match would make the template much simpler and more readable.

[ruflin]

Great to see this landed in Elasticsearch. @P1llus This should make it possible to simplify the ECS templates but not sure how you will deal with it as it is only available in newer versions of Elasticsearch.

[P1llus]

@ruflin the template that is going to be bundled with ES for logs-* should use this then, and we can handle some sort of reference in fleet, that way it can still use the template bundled with an integration for old releases.