Default application of json codec and ECS

[TheVastyDeep]

For Content-Type application/json the json codec is used by default. That is helpful, but with the introduction of ECS it creates an issue. If the target option on the codec is not set (and the plugin does not set it) then logstash logs an INFO message about ECS compatibility is enabled but target option was not specified. This can be worked around using

additional_codecs => {}
codec => json { target => "[document]" }

but that is not very obvious, and it is not specific to the Content-Type. Perhaps the documentation should address this.

[Eliav2]

absolutely! took me few hours just to understand how to place the http body fields into the target field. (codec => json { target => "[document]" } is not working unless you specify additional_codecs => {})