prefer wildcard if indexing event.original

elastic · Nov 10, 2020 · 2c0167f · 2c0167f
1 parent 8ccec9e
commit 2c0167f
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/schemas/event.yml b/schemas/event.yml
@@ -590,7 +590,9 @@
           Raw text message of entire event. Used to demonstrate log integrity.
 
           This field is not indexed and doc_values are disabled. It cannot be
-          searched, but it can be retrieved from `_source`.
+          searched, but it can be retrieved from `_source`. If users wish to
+          override this and index this field, consider using the wildcard
+          data type.
       index: false
       doc_values: false