Increase total fields limit from 2000 to 2500 (#2584)

* Increase total fields limit from 2000 to 2500

# ECS 9.3.0 Specification Analysis

## Total Field Count

| Version | Fields | Multi-fields | Total |
|---------|--------|--------------|-------|
| v9.3.0 | 2,141 | 123 | **2,264** |
| v9.0.0 | 1,848 | 91 | **1,939** |
| **Delta** | **+293** | **+32** | **+325 (16.8%)** |

## Special Field Types

| Type | v9.0.0 | v9.3.0 | Change |
|------|--------|--------|--------|
| `object` (container/grouping) | 15 | 90 | +75 (+500%) |
| `nested` (array-type) | 25 | 28 | +3 |
| Fields with `multi_fields` | 91 | 123 | +32 |

## New Field Sets in v9.3.0

| Field Set | Fields |
|-----------|--------|
| `entity` | 26 |
| `gen_ai` | 26 |
| **Total** | **52** |

## Field Sets with Significant Growth

| Field Set | v9.0.0 | v9.3.0 | Growth | % Change |
|-----------|--------|--------|--------|----------|
| `user` | 46 | 116 | +70 | +152% |
| `host` | 42 | 110 | +68 | +162% |
| `cloud` | 33 | 72 | +39 | +118% |
| `service` | 33 | 72 | +39 | +118% |
| `orchestrator` | 15 | 28 | +13 | +87% |
| `device` | 5 | 10 | +5 | +100% |
| `process` | 389 | 391 | +2 | +0.5% |
| `threat` | 435 | 437 | +2 | +0.5% |

## Largest Field Sets (v9.3.0)

| Field Set | Fields | % of Total |
|-----------|--------|------------|
| `threat` | 437 | 19.3% |
| `process` | 391 | 17.3% |
| `file` | 144 | 6.4% |
| `user` | 116 | 5.1% |
| `host` | 110 | 4.9% |
| `tls` | 77 | 3.4% |
| `cloud` | 72 | 3.2% |
| `service` | 72 | 3.2% |
| `dll` | 46 | 2.0% |
| `observer` | 41 | 1.8% |

## Summary

- **54 total field sets**: 2 new, 6 with growth, 46 unchanged
- **Growth drivers**: new field sets (`entity`, `gen_ai`) account for 52 fields; existing field set expansions (`user`, `host`, `cloud`, `service`, `orchestrator`, `device`) account for 241 fields; 32 new multi-field variants
- The `object` type count jumped from 15 to 90 — these are the entity sub-objects added to `user`, `host`, `cloud`, `service`, and `orchestrator` for the new `entity` reuse pattern
- The current composable template ships with `total_fields.limit: 2000`, which is insufficient for the 2,264 fields in v9.3.0

* Generate artifacts and add changelog entry

---------

Co-authored-by: Kylie Meli <kylie.geller@elastic.co>

Author: Mpdreamz

CHANGELOG.next.md

@@ -30,6 +30,8 @@ Thanks, you're awesome :-) -->
 
 #### Improvements
 
+* Increase composable template `total_fields.limit` from 2000 to 2500. #2584
+
 #### Deprecated
 
 <!-- All empty sections:

experimental/generated/elasticsearch/composable/template.json

@@ -72,7 +72,7 @@
         "codec": "best_compression",
         "mapping": {
           "total_fields": {
-            "limit": 2000
+            "limit": 2500
           }
         }
       }

generated/elasticsearch/composable/template.json

@@ -71,7 +71,7 @@
         "codec": "best_compression",
         "mapping": {
           "total_fields": {
-            "limit": 2000
+            "limit": 2500
           }
         }
       }

scripts/generators/es_template.py

@@ -291,7 +291,7 @@ def default_template_settings(ecs_version: str) -> Dict:
                     "codec": "best_compression",
                     "mapping": {
                         "total_fields": {
-                            "limit": 2000
+                            "limit": 2500
                         }
                     }
                 }