[Change Proposal] Support 'synthetic_source_keep' in field mapping attributes

[andrewkroh]

synthetic_source_keep is a mapping attribute added to Elasticsearch 8.16 that controls the behavior of a field under sythentic_source and LogsDB.

Integrations need to be able to specify this attribute to optimize the behavior of certain array fields in order to minimize storage costs. For example, an integration that stores a list of IP address would set synthetic_source_keep: none when the value is treated as a unsorted set (ordering does not matter and duplicate values have no meaning). Then the storage of the field can be optimized by not storing the original value in the _source.

[jsoriano]

Do you know if this attribute replaces store? We have found that it is not leveraged in 8.18 when included in component templates, see #860.

[andrewkroh]

I don't know for sure. I don't think it replaces store, but perhaps when synthetic_source is enabled only synthetic_source_keep is honored.

[jsoriano]

Issue with store resolved. It is enabled by default in text fields since 8.18, and default fields are generally not included in mappings. I am adjusting the test in #860.