Map message field to match_only_text for custom logs input package

[gsantoro]

What does this PR do?

Add support for ECS dynamic templates in the custom logs integration defined in the log input package

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

• [ ]

How to test this PR locally

• Install the new version of the package in elastic-package
• check that the field message has mapping match_only_text instead of keyword

Related issues

• Closes [Log] Message field is keyword #6566 6566

Screenshots

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 4f3e564

History

• 💚 Build #85 succeeded 22e67d1

cc @gsantoro

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-06-14T11:25:21.735+0000

• Duration: 15 min 33 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[ruflin]

Change LGTM. I basically means by default, the user gets all the ECS mappings for logs.

[ycombinator]

Tested and I see the following mapping in the custom logs component template:

{
  "_embedded_ecs-message_match_only_text": {
    "path_match": "message",
    "mapping": {
      "type": "match_only_text"
    }
  }
}

[elasticmachine]

Package log - 2.1.0 containing this change is available at https://epr.elastic.co/search?package=log

[ruflin]

I'm too late, but it is actually a bug fix not an enhancement.

[gsantoro]

Sorry about this. Is there anything we can do?

[ruflin]

I guess we could fix it in a follow up. Lets just keep it for now and consider it a bug :-)