message_id proposed to use wildcard

docs/fields/field-details.asciidoc

@@ -2700,7 +2700,7 @@ example: `c26dbea0-80d5-463b-b93c-4e8b708219ce`
 
 | Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email message.
 
-type: keyword
+type: wildcard
 
 
 

experimental/generated/beats/fields.ecs.yml

@@ -2013,8 +2013,7 @@
       default_field: false
     - name: message_id
       level: extended
-      type: keyword
-      ignore_above: 1024
+      type: wildcard
       description: Identifier from the RFC 5322 `Message-ID:` email header that refers
         to a particular email message.
       example: <[email protected]>

experimental/generated/csv/fields.csv

@@ -204,7 +204,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.1.0-dev+exp,true,email,email.direction,keyword,extended,,inbound,Direction of the message.
 8.1.0-dev+exp,true,email,email.from.address,keyword,extended,array,[email protected],The sender's email address.
 8.1.0-dev+exp,true,email,email.local_id,keyword,extended,,c26dbea0-80d5-463b-b93c-4e8b708219ce,Unique identifier given by the source.
-8.1.0-dev+exp,true,email,email.message_id,keyword,extended,,<[email protected]>,Value from the Message-ID header.
+8.1.0-dev+exp,true,email,email.message_id,wildcard,extended,,<[email protected]>,Value from the Message-ID header.
 8.1.0-dev+exp,true,email,email.origination_timestamp,date,extended,,2020-11-10T22:12:34.8196921Z,Date and time the email was composed.
 8.1.0-dev+exp,true,email,email.reply_to.address,keyword,extended,array,[email protected],Address replies should be delivered to.
 8.1.0-dev+exp,true,email,email.sender.address,keyword,extended,,,Address of the message sender.

experimental/generated/ecs/ecs_flat.yml

@@ -2508,12 +2508,11 @@ email.message_id:
     to a particular email message.
   example: <[email protected]>
   flat_name: email.message_id
-  ignore_above: 1024
   level: extended
   name: message_id
   normalize: []
   short: Value from the Message-ID header.
-  type: keyword
+  type: wildcard
 email.origination_timestamp:
   dashed_name: email-origination-timestamp
   description: The date and time the email message was composed. Many email clients

experimental/generated/ecs/ecs_nested.yml

@@ -3341,12 +3341,11 @@ email:
         to a particular email message.
       example: <[email protected]>
       flat_name: email.message_id
-      ignore_above: 1024
       level: extended
       name: message_id
       normalize: []
       short: Value from the Message-ID header.
-      type: keyword
+      type: wildcard
     email.origination_timestamp:
       dashed_name: email-origination-timestamp
       description: The date and time the email message was composed. Many email clients

experimental/generated/elasticsearch/7/template.json

@@ -1047,8 +1047,7 @@
             "type": "keyword"
           },
           "message_id": {
-            "ignore_above": 1024,
-            "type": "keyword"
+            "type": "wildcard"
           },
           "origination_timestamp": {
             "type": "date"

experimental/generated/elasticsearch/component/email.json

@@ -104,8 +104,7 @@
               "type": "keyword"
             },
             "message_id": {
-              "ignore_above": 1024,
-              "type": "keyword"
+              "type": "wildcard"
             },
             "origination_timestamp": {
               "type": "date"

generated/beats/fields.ecs.yml

@@ -1925,8 +1925,7 @@
       default_field: false
     - name: message_id
       level: extended
-      type: keyword
-      ignore_above: 1024
+      type: wildcard
       description: Identifier from the RFC 5322 `Message-ID:` email header that refers
         to a particular email message.
       example: <[email protected]>

generated/csv/fields.csv

@@ -191,7 +191,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 8.1.0-dev,true,email,email.direction,keyword,extended,,inbound,Direction of the message.
 8.1.0-dev,true,email,email.from.address,keyword,extended,array,[email protected],The sender's email address.
 8.1.0-dev,true,email,email.local_id,keyword,extended,,c26dbea0-80d5-463b-b93c-4e8b708219ce,Unique identifier given by the source.
-8.1.0-dev,true,email,email.message_id,keyword,extended,,<[email protected]>,Value from the Message-ID header.
+8.1.0-dev,true,email,email.message_id,wildcard,extended,,<[email protected]>,Value from the Message-ID header.
 8.1.0-dev,true,email,email.origination_timestamp,date,extended,,2020-11-10T22:12:34.8196921Z,Date and time the email was composed.
 8.1.0-dev,true,email,email.reply_to.address,keyword,extended,array,[email protected],Address replies should be delivered to.
 8.1.0-dev,true,email,email.sender.address,keyword,extended,,,Address of the message sender.

generated/ecs/ecs_flat.yml

@@ -2377,12 +2377,11 @@ email.message_id:
     to a particular email message.
   example: <[email protected]>
   flat_name: email.message_id
-  ignore_above: 1024
   level: extended
   name: message_id
   normalize: []
   short: Value from the Message-ID header.
-  type: keyword
+  type: wildcard
 email.origination_timestamp:
   dashed_name: email-origination-timestamp
   description: The date and time the email message was composed. Many email clients

generated/ecs/ecs_nested.yml

@@ -3199,12 +3199,11 @@ email:
         to a particular email message.
       example: <[email protected]>
       flat_name: email.message_id
-      ignore_above: 1024
       level: extended
       name: message_id
       normalize: []
       short: Value from the Message-ID header.
-      type: keyword
+      type: wildcard
     email.origination_timestamp:
       dashed_name: email-origination-timestamp
       description: The date and time the email message was composed. Many email clients

generated/elasticsearch/7/template.json

@@ -953,8 +953,7 @@
             "type": "keyword"
           },
           "message_id": {
-            "ignore_above": 1024,
-            "type": "keyword"
+            "type": "wildcard"
           },
           "origination_timestamp": {
             "type": "date"

schemas/email.yml

@@ -123,7 +123,7 @@
 
     - name: message_id
       level: extended
-      type: keyword
+      type: wildcard
       short: Value from the Message-ID header.
       description: >
         Identifier from the RFC 5322 `Message-ID:` email header that refers to a particular email