address review feedback

README.md

@@ -425,7 +425,7 @@ The user_agent fields normally come from a browser request. They often show up i
 
 | Field  | Description  | Type  | Multi Field  | Example  |
 |---|---|---|---|---|
-| <a name="user_agent.original"></a>user_agent.original  | Unparsed version of the user_agent.  | keyword  |   |   |
+| <a name="user_agent.original"></a>user_agent.original  | Unparsed version of the user_agent.  | text  |   |   |
 | <a name="user_agent.device"></a>user_agent.device  | Name of the physical device.  | keyword  |   |   |
 | <a name="user_agent.version"></a>user_agent.version  | Version of the physical device.  | keyword  |   |   |
 | <a name="user_agent.major"></a>user_agent.major  | Major version of the user agent.  | long  |   |   |

schema.csv

@@ -149,7 +149,7 @@ user_agent.device,keyword,0,
 user_agent.major,long,0,
 user_agent.minor,long,0,
 user_agent.name,keyword,0,Chrome
-user_agent.original,keyword,0,
+user_agent.original,text,0,
 user_agent.os.major,long,0,
 user_agent.os.minor,long,0,
 user_agent.os.name,keyword,0,

schemas/user_agent.yml

@@ -7,7 +7,7 @@
     show up in web service logs coming from the parsed user agent string.
   fields:
     - name: original
-      type: keyword
+      type: text
       description: >
         Unparsed version of the user_agent.
     - name: device

template.json

@@ -782,8 +782,8 @@
               "type": "keyword"
             },
             "original": {
-              "ignore_above": 1024,
-              "type": "keyword"
+              "norms": false,
+              "type": "text"
             },
             "os": {
               "properties": {

use-cases/filebeat-apache-access.md

@@ -21,7 +21,7 @@ ECS fields used in Filebeat for the apache module.
 | <a name="http.response.body_sent.bytes"></a>*http.response.body_sent.bytes*  | *Http response body bytes sent, currently apache.access.body_sent.bytes*  | long  |   | `117`  |
 | <a name="http.referer"></a>*http.referer*  | *Http referrer code, currently apache.access.referrer<br/>NOTE: In the RFC its misspell as referer and has become accepted standard*  | keyword  |   | `http://elastic.co/`  |
 | <a name="user_agent.&ast;"></a>*user_agent.&ast;*  | *User agent fields as in schema. Currently under apache.access.user_agent.*<br/>*  |   |   |   |
-| <a name="user_agent.raw"></a>*user_agent.raw*  | *Raw user agent. Currently apache.access.agent*  | text  |   | `http://elastic.co/`  |
+| [user_agent.original](https://github.com/elastic/ecs#user_agent.original)  | Original user agent. Currently apache.access.agent  | text  |   | `http://elastic.co/`  |
 | <a name="geoip.&ast;"></a>*geoip.&ast;*  | *User agent fields as in schema. Currently under apache.access.geoip.*<br/>These are extracted from source.ip<br/>Should they be under source.geoip?<br/>*  |   |   |   |
 | <a name="geoip...."></a>*geoip....*  | *All geoip fields.*  | text  |   |   |
 

use-cases/filebeat-apache-access.yml

@@ -90,10 +90,10 @@ fields:
   description: >
     User agent fields as in schema. Currently under apache.access.user_agent.*
   fields:
-    - name: raw
+    - name: original
       type: text
       description: >
-        Raw user agent. Currently apache.access.agent
+        Original user agent. Currently apache.access.agent
       example: http://elastic.co/
 
 - name: geoip