What will be the impact if i change the ECS recommended data type for ECS fields. For example what if i map the event.action field as 'text' datatype instead of keyword.
I am receiving the following values in event action.
values: PRofile created, profile CREATED, Profile CreateD etc. I want to query/search this event.action field as case insensitive.
so i want to change the data type from ecs recommended keyword to text type to do analyzed search.