Currently, the plugin by default initializes ECS compatibility enabled plain codec. Codec will take message and move it to event.original field. This effectively changes the data indexed into Elasticsearch, especially, user changes from beats -> ES to beats -> LS -> ES.
The plugin should have an option to control the situation where adding source and codec metadata need to be decided.
Issue description
Currently, the plugin by default initializes ECS compatibility enabled plain codec. Codec will take message and move it to
event.originalfield. This effectively changes the data indexed into Elasticsearch, especially, user changes from beats -> ES to beats -> LS -> ES.The plugin should have an option to control the situation where adding source and codec metadata need to be decided.