store related event data as a flattened object blob

salt/elasticsearch/templates/so/so-case-template.json.jinja

@@ -22,17 +22,6 @@
     },
     "dynamic": false,
     "date_detection": false,
-    "dynamic_templates": [
-      {
-        "strings_as_keyword": {
-          "mapping": {
-            "ignore_above": 1024,
-            "type": "keyword"
-          },
-          "match_mapping_type": "string"
-        }
-      }
-    ],
     "properties": {
       "@timestamp": {
         "type": "date"
@@ -221,6 +210,15 @@
           "createTime": {
             "type": "date"
           },
+          "fields": {
+            "eager_global_ordinals": false,
+            "ignore_above": 1024,
+            "index": true,
+            "type": "flattened",
+            "index_options": "docs",
+            "split_queries_on_whitespace": false,
+            "doc_values": true
+          },
           "userId": {
             "type": "keyword",
             "ignore_above": 1024