Add parameter to use patterned_text for message field

[parkertimmins]

Add parameter patterned_text_message_field to logs track. If set to true, all message and error.message fields in the elastic logs track will be of type patterned_text. If set to false, type will be match_only_text. Defaults to false.

[parkertimmins]

There are no queries which explicitly search for message or error.messag. However, there are many workflows with multi_match and multi_match with type=phrase. @martijnvg Do you think these are sufficient? Or should we add some explicit match and match_phrase queries on message fields?

[martijnvg]

LGTM

[martijnvg]

Do you think these are sufficient? Or should we add some explicit match and match_phrase queries on message fields?

I thought the queries always relied on the default query fields and iirc message if part of that list. If that isn't the case then queries directly on message field makes sense.

[parkertimmins]

Ahh, you're correct. Every index does define a list of default fields and the message fields are in those lists.

[gbanasiak]

p_patterned_text_message_field is undefined in template context, because templates are not rendered under track.json tree.

The fix options are:

• repeat p_patterned_text_message_field definition at the top of each template file:

{% set p_patterned_text_message_field = (patterned_text_message_field | default(false)) %}

• use patterned_text_message_field directly with relevant default(false) filter expression.

[gbanasiak]

Perhaps default(false) is not even needed, worth a check.