Remove guidance to lowercase http.request.method. (#1443)

* remove guidance to lowercase

* generate artifacts

* changelog

CHANGELOG.next.md

@@ -13,6 +13,7 @@ Thanks, you're awesome :-) -->
 * Removing deprecated --oss from generator #1404
 * Removing use-cases directory #1405
 * Remove `host.user.*` field reuse. #1439
+* Remove deprecation notice on `http.request.method`. #1443
 
 ### Schema Changes
 

docs/field-details.asciidoc

@@ -4235,17 +4235,13 @@ example: `123e4567-e89b-12d3-a456-426614174000`
 
 | HTTP request method.
 
-Prior to ECS 1.6.0 the following guidance was provided:
-
-"The field value must be normalized to lowercase for querying."
-
-As of ECS 1.6.0, the guidance is deprecated because the original case of the method may be useful in anomaly detection.  Original case will be mandated in ECS 2.0.0
+The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field.
 
 type: keyword
 
 
 
-example: `GET, POST, PUT, PoST`
+example: `POST`
 
 | extended
 

experimental/generated/beats/fields.ecs.yml

@@ -3355,14 +3355,9 @@
       ignore_above: 1024
       description: 'HTTP request method.
 
-        Prior to ECS 1.6.0 the following guidance was provided:
-
-        "The field value must be normalized to lowercase for querying."
-
-        As of ECS 1.6.0, the guidance is deprecated because the original case of the
-        method may be useful in anomaly detection.  Original case will be mandated
-        in ECS 2.0.0'
-      example: GET, POST, PUT, PoST
+        The value should retain its casing from the original event. For example, `GET`,
+        `get`, and `GeT` are all considered valid values for this field.'
+      example: POST
     - name: request.mime_type
       level: extended
       type: keyword

experimental/generated/csv/fields.csv

@@ -377,7 +377,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 2.0.0-dev+exp,true,http,http.request.body.content.text,text,extended,,Hello world,The full HTTP request body.
 2.0.0-dev+exp,true,http,http.request.bytes,long,extended,,1437,Total size in bytes of the request (body and headers).
 2.0.0-dev+exp,true,http,http.request.id,keyword,extended,,123e4567-e89b-12d3-a456-426614174000,HTTP request ID.
-2.0.0-dev+exp,true,http,http.request.method,keyword,extended,,"GET, POST, PUT, PoST",HTTP request method.
+2.0.0-dev+exp,true,http,http.request.method,keyword,extended,,POST,HTTP request method.
 2.0.0-dev+exp,true,http,http.request.mime_type,keyword,extended,,image/gif,Mime type of the body of the request.
 2.0.0-dev+exp,true,http,http.request.referrer,wildcard,extended,,https://blog.example.com/,Referrer for this HTTP request.
 2.0.0-dev+exp,true,http,http.response.body.bytes,long,extended,,887,Size in bytes of the response body.

experimental/generated/ecs/ecs_flat.yml

@@ -4956,13 +4956,9 @@ http.request.method:
   dashed_name: http-request-method
   description: 'HTTP request method.
 
-    Prior to ECS 1.6.0 the following guidance was provided:
-
-    "The field value must be normalized to lowercase for querying."
-
-    As of ECS 1.6.0, the guidance is deprecated because the original case of the method
-    may be useful in anomaly detection.  Original case will be mandated in ECS 2.0.0'
-  example: GET, POST, PUT, PoST
+    The value should retain its casing from the original event. For example, `GET`,
+    `get`, and `GeT` are all considered valid values for this field.'
+  example: POST
   flat_name: http.request.method
   ignore_above: 1024
   level: extended

experimental/generated/ecs/ecs_nested.yml

@@ -6090,14 +6090,9 @@ http:
       dashed_name: http-request-method
       description: 'HTTP request method.
 
-        Prior to ECS 1.6.0 the following guidance was provided:
-
-        "The field value must be normalized to lowercase for querying."
-
-        As of ECS 1.6.0, the guidance is deprecated because the original case of the
-        method may be useful in anomaly detection.  Original case will be mandated
-        in ECS 2.0.0'
-      example: GET, POST, PUT, PoST
+        The value should retain its casing from the original event. For example, `GET`,
+        `get`, and `GeT` are all considered valid values for this field.'
+      example: POST
       flat_name: http.request.method
       ignore_above: 1024
       level: extended

generated/beats/fields.ecs.yml

@@ -2969,14 +2969,9 @@
       ignore_above: 1024
       description: 'HTTP request method.
 
-        Prior to ECS 1.6.0 the following guidance was provided:
-
-        "The field value must be normalized to lowercase for querying."
-
-        As of ECS 1.6.0, the guidance is deprecated because the original case of the
-        method may be useful in anomaly detection.  Original case will be mandated
-        in ECS 2.0.0'
-      example: GET, POST, PUT, PoST
+        The value should retain its casing from the original event. For example, `GET`,
+        `get`, and `GeT` are all considered valid values for this field.'
+      example: POST
     - name: request.mime_type
       level: extended
       type: keyword

generated/csv/fields.csv

@@ -315,7 +315,7 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Normalization,Example,Description
 2.0.0-dev,true,http,http.request.body.content.text,text,extended,,Hello world,The full HTTP request body.
 2.0.0-dev,true,http,http.request.bytes,long,extended,,1437,Total size in bytes of the request (body and headers).
 2.0.0-dev,true,http,http.request.id,keyword,extended,,123e4567-e89b-12d3-a456-426614174000,HTTP request ID.
-2.0.0-dev,true,http,http.request.method,keyword,extended,,"GET, POST, PUT, PoST",HTTP request method.
+2.0.0-dev,true,http,http.request.method,keyword,extended,,POST,HTTP request method.
 2.0.0-dev,true,http,http.request.mime_type,keyword,extended,,image/gif,Mime type of the body of the request.
 2.0.0-dev,true,http,http.request.referrer,keyword,extended,,https://blog.example.com/,Referrer for this HTTP request.
 2.0.0-dev,true,http,http.response.body.bytes,long,extended,,887,Size in bytes of the response body.

generated/ecs/ecs_flat.yml

@@ -4247,13 +4247,9 @@ http.request.method:
   dashed_name: http-request-method
   description: 'HTTP request method.
 
-    Prior to ECS 1.6.0 the following guidance was provided:
-
-    "The field value must be normalized to lowercase for querying."
-
-    As of ECS 1.6.0, the guidance is deprecated because the original case of the method
-    may be useful in anomaly detection.  Original case will be mandated in ECS 2.0.0'
-  example: GET, POST, PUT, PoST
+    The value should retain its casing from the original event. For example, `GET`,
+    `get`, and `GeT` are all considered valid values for this field.'
+  example: POST
   flat_name: http.request.method
   ignore_above: 1024
   level: extended

generated/ecs/ecs_nested.yml

@@ -5366,14 +5366,9 @@ http:
       dashed_name: http-request-method
       description: 'HTTP request method.
 
-        Prior to ECS 1.6.0 the following guidance was provided:
-
-        "The field value must be normalized to lowercase for querying."
-
-        As of ECS 1.6.0, the guidance is deprecated because the original case of the
-        method may be useful in anomaly detection.  Original case will be mandated
-        in ECS 2.0.0'
-      example: GET, POST, PUT, PoST
+        The value should retain its casing from the original event. For example, `GET`,
+        `get`, and `GeT` are all considered valid values for this field.'
+      example: POST
       flat_name: http.request.method
       ignore_above: 1024
       level: extended

schemas/http.yml

@@ -28,16 +28,11 @@
       description: >
         HTTP request method.
 
-        Prior to ECS 1.6.0 the following guidance was provided:
+        The value should retain its casing from the original event.
+        For example, `GET`, `get`, and `GeT` are all considered valid values
+        for this field.
 
-        "The field value must be normalized to lowercase for
-        querying."
-
-        As of ECS 1.6.0, the guidance is deprecated because the
-        original case of the method may be useful in anomaly
-        detection.  Original case will be mandated in ECS 2.0.0
-
-      example: GET, POST, PUT, PoST
+      example: POST
 
     - name: request.mime_type
       level: extended