Repository: elastic/ecs

Issue:
Generator does not add "ignore_above" property for field type: flattened
<!--
GitHub is reserved for bug reports and feature requests; it is not the place
for general questions. If you have a general question, please visit the
discuss forums: https://discuss.elastic.co/tag/ecs-elastic-common-schema.

Please fill in the following details to help us reproduce the bug:
-->

**Description of the problem including expected versus actual behavior**:
Generator does not write the property: `ignore_above` for field type: `flattened`


**Steps to reproduce**:

Create a field in a field set that is flattened with the ignore above key

```yaml

    - name: enrichment_data
      level: custom
      type: flattened
      description: >-
        Flattened object of enrichment data.
      ignore_above: 1024

```

Please include a *minimal* but *complete* recreation of the problem.

1. Created field set ecs file
2. Added field set to subset.yml
3. Generated artifacts
4. Examine generated component template with flattened field.

**Provide logs (if relevant)**:

Generated component template

```json
{
  "_meta": {
    "ecs_version": "8.8.0"
  },
  "template": {
    "mappings": {
      "properties": {
        "enrichment_data": {
          "type": "flattened"
        }
      }
    }
  }
}

```

**Any additional context:**
This key is necessary so elasticsearch does not try to index fields with large values. 

Note: Adding the property after the component template is generated works as a temporary workaround. 


Discussion:

Resolving patch:
diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py
--- a/scripts/generators/es_template.py
+++ b/scripts/generators/es_template.py
@@ -191,7 +191,7 @@ def entry_for(field: Field) -> Dict:
         elif 'index' in field and not field['index']:
             ecs_helpers.dict_copy_existing_keys(field, field_entry, ['index', 'doc_values'])
 
-        if field['type'] == 'keyword':
+        if field['type'] == 'keyword' or field['type'] == 'flattened':
             ecs_helpers.dict_copy_existing_keys(field, field_entry, ['ignore_above'])
         elif field['type'] == 'constant_keyword':
             ecs_helpers.dict_copy_existing_keys(field, field_entry, ['value'])


Test patch:
diff --git a/scripts/tests/test_es_template.py b/scripts/tests/test_es_template.py
--- a/scripts/tests/test_es_template.py
+++ b/scripts/tests/test_es_template.py
@@ -174,6 +174,44 @@ def test_constant_keyword_no_value(self):
         exp = {'type': 'constant_keyword'}
         self.assertEqual(es_template.entry_for(test_map), exp)
 
+    def test_keyword_pass_ignore_above(self):
+        test_map = {
+            'name': 'field_with_ignore_above_set',
+            'type': 'keyword',
+            'ignore_above': 1024
+        }
+
+        exp = {
+            'type': 'keyword',
+            'ignore_above': 1024
+        }
+        self.assertEqual(es_template.entry_for(test_map), exp)
+
+    def test_flattened_pass_ignore_above(self):
+        test_map = {
+            'name': 'field_with_ignore_above_set',
+            'type': 'flattened',
+            'ignore_above': 1024
+        }
+
+        exp = {
+            'type': 'flattened',
+            'ignore_above': 1024
+        }
+        self.assertEqual(es_template.entry_for(test_map), exp)
+
+    def test_other_types_not_pass_ignore_above(self):
+        test_map = {
+            'name': 'field_should_not_have_ignore_above_set',
+            'type': 'text',
+            'ignore_above': 1024
+        }
+
+        exp = {
+            'type': 'text'
+        }
+        self.assertEqual(es_template.entry_for(test_map), exp)
+
     def test_parameters(self):
         test_map = {
             'name': 'field_with_parameters',