Hi Roger,
Interesting. metricbeat-7.0.0 should have the index.query.default_field setting in the template. Can you check GET /_template/metricbeat-7.0.0?
The setting was added to the Metricbeat template in libbeat 6.7.x per https://github.com/elastic/beats/pull/11205.
You can set indices.query.bool.max_clause_count: 2000 in elasticsearch.yml to avoid any issues during the upgrade.
Jason