[Fleet] ignore_above should not be added to fields with 'index: false'

[andrewkroh]

Kibana version: main / 8.4.0-SNAPHSOT / ac15ee4

Describe the bug:

EPM adds a default ignore_above: 1024 to fields when they are not indexed. If a field is defined with index: false then EPM should not add ignore_above. We can see in this in event.original which is not indexed:

{
  "mappings": {
    "event.original": {
      "full_name": "event.original",
      "mapping": {
        "original": {
          "type": "keyword",
          "index": false,
          "doc_values": false,
          "ignore_above": 1024
        }
      }
    }
  }
}

Any additional context:

• Remove ignore_above setting when not indexing field ecs#1481
• Add option to return ignored values as part of response elasticsearch#74121 (comment)

kibana/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts

Lines 257 to 260 in e6c35a6

	function generateKeywordMapping(field: Field): IndexTemplateMapping {
	const mapping: IndexTemplateMapping = {
	ignore_above: DEFAULT_IGNORE_ABOVE,
	};

kibana/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.ts

Lines 285 to 288 in e6c35a6

	function generateWildcardMapping(field: Field): IndexTemplateMapping {
	const mapping: IndexTemplateMapping = {
	ignore_above: DEFAULT_IGNORE_ABOVE,
	};

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[jen-huang]

@andrewkroh Should ignore_above also be removed when doc_values: false?

[andrewkroh]

Yes, according to elastic/ecs#1481 (comment) ignore_above should also be removed when doc_value: false.