Add tags to action request documents (#642)

Author: pzl

custom_schemas/custom_action_space.yml

@@ -14,4 +14,11 @@
       short: originating space ID
       description: >
         The space ID that the action was initiated from
+    - name: tags
+      title: Tags
+      type: keyword
+      level: custom
+      short: internal categorization
+      description: >
+        Internal category flags for space awareness and future flags
 

custom_subsets/elastic_endpoint/actions/actions.yaml

@@ -31,6 +31,7 @@ fields:
   space:
     fields:
       originSpaceId: {}
+      tags: {}
   rule:
     fields:
       id: {}

package/endpoint/data_stream/actions/fields/fields.yml

@@ -342,6 +342,12 @@
   type: keyword
   ignore_above: 1024
   description: The space ID that the action was initiated from
+- name: tags
+  level: custom
+  type: keyword
+  ignore_above: 1024
+  description: Internal category flags for space awareness and future flags
+  default_field: true
 - name: user
   title: User
   group: 2

package/endpoint/data_stream/actions/sample_event.json

@@ -29,6 +29,11 @@
         ]
     },
     "originSpaceId": "b88dae77-9037-459b-be31-efefa6788362",
+    "tags": [
+        "foo",
+        "bar",
+        "oldspace"
+    ],
     "@timestamp": "2022-04-04T20:44:07.805Z",
     "event": {
         "agent_id_status": "auth_metadata_missing",