Define `ecs.version` as a `constant_keyword` field
We set ecs.version using a model processor, in the apm-server code, based on the version of the github.com/elastic/ecs/code/go/ecs module in use:
https://github.com/elastic/apm-server/blob/0c6c95ff8d6fb81a32ebf38420016b7d6ba765c2/internal/beater/processors.go#L64-L72
An older version of APM Server may send documents to the data streams, and the ingest pipeline is responsible for upgrading/transforming documents to the appropriate format. Therefore I believe it makes sense for the ECS version to be set by the installed ingest pipeline and index template. We can do this by making ecs.version a constant_keyword field.
This will also allow the code to be simplified, and documents to be made (slightly) smaller.
the ingest pipeline is responsible for upgrading/transforming documents to the appropriate format.
Would this issue also contain the work to put the ingest pipeline for adding the ECS version in place?
Would this issue also contain the work to put the ingest pipeline for adding the ECS version in place?
I think all we need to do is:
- set
ecs.versionto aconstant_keywordfield in each data stream's ecs.yml file, and specify the constant value - stop setting
ecs.versionin documents sent to Elasticsearch