Document as-is field log.flags used by Beats

[ypid-geberit]

Superseeds: #1372
Implements: #191
Related to: #940, #1373

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?
• For proposing substantial changes or additions to the schema, have you reviewed the RFC process?
• If submitting code/script changes, have you verified all tests pass locally using make test?
• If submitting schema/fields updates, have you generated new artifacts by running make and committed those changes?
• Is your pull request against master? Unless there is a good reason otherwise, we prefer pull requests against master and will backport as needed.
• Have you added an entry to the CHANGELOG.next.md?

[ebeahan]

Thanks, @ypid-geberit!

I want to open up a discussion here around log.flags to a broader group. I noticed you opened the PR as a draft, though, so I'll hold for now.

Let us know if we can help get the artifacts to build or the tests to pass.

[ypid-geberit]

The draft status might be misleading. I removed it. This PR is not intended to be merged without discussion and rework, that is what I wanted to express. Potentially event.flags is a better name. This PR basically just documents the as-is use of Beats.

So, sounds good, lets discuss it.

Building the artifacts just distracts from the changes at this stage I would say (and I did not get the full tooling to work in my env, but I got enough of it working to make great use of it internally and contribute back, ref: https://github.com/geberit/elastic-ecs).

[ebeahan]

Let's continue the discussion thread in #191 and once we have a direction finalized, we can re-open the PR.