[Filebeat] Change type from haproxy.log fileset fields from text to k…

…eyword (#10397)

Fields changed:

- response.captured_headers
- request.captured_headers
- raw_request_line
- mode

CHANGELOG.next.asciidoc

@@ -58,6 +58,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
   including `http.response.elapsed_time` (ECS). {pull}10188[10188], {pull}10274[10274]
 - Rename multiple fields to `http.response.body.bytes`, from modules "apache", "iis",
   "kibana", "nginx" and "traefik", including `http.response.content_length` (ECS). {pull}10188[10188]
+- Change type from haproxy.log fileset fields from text to keyword: response.captured_headers, request.captured_headers, `raw_request_line`, `mode`. {pull}10397[10397]
 - Change type of field backend_url and frontend_name in traefik.access metricset to type keyword. {pull}10401[10401]
 - Ingesting Elasticsearch audit logs is only supported with Elasticsearch 6.5.0 and above {pull}10352[10352]
 - Migrate Elasticsearch audit logs fields to ECS {pull}10352[10352]

filebeat/docs/fields.asciidoc

@@ -4694,7 +4694,7 @@ Condition the session was in when the session ended.
 *`haproxy.mode`*::
 +
 --
-type: text
+type: keyword
 
 mode that the frontend is operating (TCP or HTTP)
 
@@ -4901,7 +4901,7 @@ Optional "name=value" entry indicating that the client had this cookie in the re
 *`haproxy.http.response.captured_headers`*::
 +
 --
-type: text
+type: keyword
 
 List of headers captured in the response due to the presence of the "capture response header" statement in the frontend.
 
@@ -4934,7 +4934,7 @@ Optional "name=value" entry indicating that the server has returned a cookie wit
 *`haproxy.http.request.captured_headers`*::
 +
 --
-type: text
+type: keyword
 
 List of headers captured in the request due to the presence of the "capture request header" statement in the frontend.
 
@@ -4944,7 +4944,7 @@ List of headers captured in the request due to the presence of the "capture requ
 *`haproxy.http.request.raw_request_line`*::
 +
 --
-type: text
+type: keyword
 
 Complete HTTP request line, including the method, request and HTTP version string.
 

filebeat/module/haproxy/_meta/fields.yml

@@ -60,7 +60,7 @@
           description: Condition the session was in when the session ended.
 
         - name: mode
-          type: text
+          type: keyword
           description: mode that the frontend is operating (TCP or HTTP)
 
         - name: connections

filebeat/module/haproxy/log/_meta/fields.yml

@@ -14,7 +14,7 @@
     - name: captured_headers
       description: >
         List of headers captured in the response due to the presence of the "capture response header" statement in the frontend.
-      type: text
+      type: keyword
 
     - name: status_code
       type: alias
@@ -32,11 +32,11 @@
     - name: captured_headers
       description: >
         List of headers captured in the request due to the presence of the "capture request header" statement in the frontend.
-      type: text
+      type: keyword
 
     - name: raw_request_line
       description: Complete HTTP request line, including the method, request and HTTP version string.
-      type: text
+      type: keyword
 
     - name: time_wait_without_data_ms
       description: Total time in milliseconds spent waiting for the server to send a full HTTP response, not counting data.