[field validation] Check values against ECS expected_values

[andrewkroh]

ECS added an expected_values list its schema to facilitate data validation. elastic-package should check data against this list when validating documents.

- name: faas
  fields:
    - name: trigger.type
      type: keyword
      expected_values:
        - http
        - pubsub
        - data source
        - timer
        - other

• expected_values in field definitions ecs#1952

[jsoriano]

What is the difference between these expected_values and the list of allowed_values supported in #771?

[andrewkroh]

See the discussion in elastic/ecs#1952 (comment). Basically allowed_values gives the relationship between event.category and event.type while expected_values is a simple list.