From 6005857170a55175d9904e66045cfdffdacae14b Mon Sep 17 00:00:00 2001
From: Robin Schneider <robin.schneider@geberit.com>
Date: Thu, 22 Apr 2021 19:18:12 +0200
Subject: [PATCH] Document as-is field log.flags used by Beats

---
 schemas/log.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/schemas/log.yml b/schemas/log.yml
index fed4c063dd..4c36b80ea2 100644
--- a/schemas/log.yml
+++ b/schemas/log.yml
@@ -60,6 +60,16 @@
         This field is not indexed and doc_values are disabled so it can't be
         queried but the value can be retrieved from `_source`.
 
+    - name: flags
+      level: extended
+      type: keyword
+      example: '["multiline", "trucated", "_grokparsefailure"]'
+      short: Flags set by the pipeline.
+      description: >
+        Flags set by the pipeline.
+
+        Metadata that can be added by the pipeline that processed the event to
+        communicate parse failures, warnings or other notable aspects.
 
     - name: logger
       level: core