Remove event_api.tags.illegal for v9

[kaisecheng]

_Do Not Merge until we got approval from breaking changes committee _
This PR should not backport to 8.x

Release notes

Removed the --event_api.tags.illegal flag, which allowed setting non string values to the tags field. Since v9, such illegal assignments will fail, resulting in a _tagsparsefailure in the tags field, and the illegal value will be written to the _tags field.

What does this PR do?

The commit removes the --event_api.tags.illegal option which is added in #14822

Why is it important/What is the impact to the user?

This is a breaking change. User no longer be able to set event_api.tags.illegal to warn as a fallback to accept the illegal assignment of tags field.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files (and/or docker env variables)
• I have added tests that prove my fix is effective or that my feature works

Author's Checklist

• run with --event_api.tags.illegal warn throws Unrecognised option
• illegal assignment is written to _tags

How to test this PR locally

1. bin/logstash -f /path/to/p.conf --event_api.tags.illegal warn should give Unrecognised option
2. Happy case

input {
    generator {
      count=> 1
      message => '{"tags": ["a","b"] }'
      codec => json
    }
}

output {
    stdout {}
}

It is valid tags and should give no error

3. Sad case

input {
    generator {
      count=> 1
      message => '{"tags": {"poison":true}}'
      codec => json
    }
}

output {
    stdout {}
}

It is invalid tags and should give _tagsparsefailure

Related issues

• Fixes: Remove event_api.tags.illegal (default becomes locked to 'rename') #16356
• relates: add deprecation log for --event_api.tags.illegal #16507

Use cases

Screenshots

Logs

[kaisecheng]

@mashhur this is ready for review

[mashhurs]

LGTM!

[mashhurs]

nit: better to import specific classes rather than entire package. I think your IntelliJ (or dev tool) made this change.

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: fdc7860

History

• 💚 Build #1660 succeeded c29e741
• 💛 Build #1590 was flaky af41aca
• 💚 Build #1552 succeeded 67e6663
• 💚 Build #1488 succeeded c7c1099