logs-apm.error-*: define log.level field as keyword (#112440)

Defines `log.level` as a `keyword` for all apm error logs.

---------

Signed-off-by: Marc Lopez Rubio <[email protected]>

docs/changelog/112440.yaml

@@ -0,0 +1,5 @@
+pr: 112440
+summary: "logs-apm.error-*: define log.level field as keyword"
+area: Data streams
+type: bug
+issues: []

x-pack/plugin/apm-data/src/main/resources/component-templates/logs-apm.error@mappings.yaml

@@ -6,6 +6,9 @@ _meta:
 template:
   mappings:
     properties:
+      # log.*
+      log.level:
+        type: keyword
       # error.*
       error.custom:
         type: object

x-pack/plugin/apm-data/src/main/resources/resources.yaml

@@ -1,7 +1,7 @@
 # "version" holds the version of the templates and ingest pipelines installed
 # by xpack-plugin apm-data. This must be increased whenever an existing template or
 # pipeline is changed, in order for it to be updated on Elasticsearch upgrade.
-version: 8
+version: 9
 
 component-templates:
   # Data lifecycle.

x-pack/plugin/apm-data/src/yamlRestTest/resources/rest-api-spec/test/20_error_logs.yml

@@ -0,0 +1,28 @@
+---
+setup:
+  - do:
+      cluster.health:
+        wait_for_events: languid
+---
+"Test logs-apm.error-* error log fields":
+  - do:
+      bulk:
+        index: logs-apm.error-log-level-testing
+        refresh: true
+        body:
+          - create: {}
+          - '{"@timestamp": "2017-06-22", "log": {"level": "error"}, "error": {"log": {"message": "loglevel"}, "exception": [{"message": "exception_used"}]}}'
+
+          - create: {}
+          - '{"@timestamp": "2017-06-22", "log": {"level": "warn"}, "error": {"log": {"message": "loglevel"}, "exception": [{"message": "exception_used"}]}}'
+
+  - is_false: errors
+
+  - do:
+      search:
+        index: logs-apm.error-log-level-testing
+        body:
+          fields: ["log.level"]
+  - length: { hits.hits: 2 }
+  - match: { hits.hits.0.fields: { "log.level": ["error"] } }
+  - match: { hits.hits.1.fields: { "log.level": ["warn"] } }