From a16b0fada29133c46496b3abd9f254021f3301cf Mon Sep 17 00:00:00 2001
From: Lee Hinman <57081003+leehinman@users.noreply.github.com>
Date: Mon, 4 May 2020 09:34:51 -0500
Subject: [PATCH] Document recent changes to nginx fileset as breaking changes
 (#18026) (#18113)

PR #17844 introduced the following changes:

- http.request.method is now lowercase
- http.request.referrer is only set when nginx provides a value

This PR updates the CHANGELOG to report this as a breaking change.

(cherry picked from commit 0de9b67c48891d032033de52c5ddaec3e110b692)
---
 CHANGELOG.next.asciidoc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 993c9f1d051..59add30b3d9 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -33,6 +33,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix parsing of Elasticsearch node name by `elasticsearch/slowlog` fileset. {pull}14547[14547]
 - CEF extensions are now mapped to the data types defined in the CEF guide. {pull}14342[14342]
 - Improve ECS field mappings in panw module.  event.outcome now only contains success/failure per ECS specification. {issue}16025[16025] {pull}17910[17910]
+- Improve ECS categorization field mappings for nginx module. http.request.referrer is now lowercase & http.request.referrer only populated when nginx sets a value {issue}16174[16174] {pull}17844[17844]
 
 *Heartbeat*