From f56ad2c2f2cb321619aad4695d816adc49f1f8c7 Mon Sep 17 00:00:00 2001
From: Tudor Golubenco <tudor@packetbeat.com>
Date: Tue, 7 Feb 2017 23:17:16 +0100
Subject: [PATCH] Bring back the _all field in 5.x

This is a temporary solution for #3368, to avoid a breaking change
in 5.x.
---
 filebeat/filebeat.template.json      |  3 +++
 heartbeat/heartbeat.template.json    |  3 +++
 libbeat/scripts/generate_template.py | 14 +++++++-------
 metricbeat/metricbeat.template.json  |  3 +++
 packetbeat/packetbeat.template.json  |  3 +++
 winlogbeat/winlogbeat.template.json  |  3 +++
 6 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/filebeat/filebeat.template.json b/filebeat/filebeat.template.json
index ab16f8b740c..63695153ae9 100644
--- a/filebeat/filebeat.template.json
+++ b/filebeat/filebeat.template.json
@@ -1,6 +1,9 @@
 {
   "mappings": {
     "_default_": {
+      "_all": {
+        "norms": false
+      },
       "_meta": {
         "version": "5.3.0"
       },
diff --git a/heartbeat/heartbeat.template.json b/heartbeat/heartbeat.template.json
index 56fa214f170..329bb697cb2 100644
--- a/heartbeat/heartbeat.template.json
+++ b/heartbeat/heartbeat.template.json
@@ -1,6 +1,9 @@
 {
   "mappings": {
     "_default_": {
+      "_all": {
+        "norms": false
+      },
       "_meta": {
         "version": "5.3.0"
       },
diff --git a/libbeat/scripts/generate_template.py b/libbeat/scripts/generate_template.py
index 8abf5d5190c..20b4b5fab4c 100644
--- a/libbeat/scripts/generate_template.py
+++ b/libbeat/scripts/generate_template.py
@@ -59,13 +59,6 @@ def fields_to_es_template(args, input, output, index, version):
         }
     }
 
-    # should be done only for es5x. For es6x, any "_all" setting results
-    # in an error.
-    # TODO: https://github.com/elastic/beats/issues/3368
-    # template["mappings"]["_default"]["_all"] = {
-    #     "norms": False
-    # }
-
     if args.es2x:
         # different syntax for norms
         template["mappings"]["_default_"]["_all"] = {
@@ -79,6 +72,13 @@ def fields_to_es_template(args, input, output, index, version):
         # limit shouldn't be that bad.
         template["settings"]["index.mapping.total_fields.limit"] = 10000
 
+        # should be done only for es5x. For es6x, any "_all" setting results
+        # in an error.
+        # TODO: https://github.com/elastic/beats/issues/3368
+        template["mappings"]["_default_"]["_all"] = {
+            "norms": False
+        }
+
     properties = {}
     dynamic_templates = []
 
diff --git a/metricbeat/metricbeat.template.json b/metricbeat/metricbeat.template.json
index 1961f3c83e4..da3e01ba0d4 100644
--- a/metricbeat/metricbeat.template.json
+++ b/metricbeat/metricbeat.template.json
@@ -1,6 +1,9 @@
 {
   "mappings": {
     "_default_": {
+      "_all": {
+        "norms": false
+      },
       "_meta": {
         "version": "5.3.0"
       },
diff --git a/packetbeat/packetbeat.template.json b/packetbeat/packetbeat.template.json
index 2ceeede136e..ee99a1b8053 100644
--- a/packetbeat/packetbeat.template.json
+++ b/packetbeat/packetbeat.template.json
@@ -1,6 +1,9 @@
 {
   "mappings": {
     "_default_": {
+      "_all": {
+        "norms": false
+      },
       "_meta": {
         "version": "5.3.0"
       },
diff --git a/winlogbeat/winlogbeat.template.json b/winlogbeat/winlogbeat.template.json
index 6fff6a67c47..7cfb0d3becc 100644
--- a/winlogbeat/winlogbeat.template.json
+++ b/winlogbeat/winlogbeat.template.json
@@ -1,6 +1,9 @@
 {
   "mappings": {
     "_default_": {
+      "_all": {
+        "norms": false
+      },
       "_meta": {
         "version": "5.3.0"
       },