Add ECS known issue for ecs@mappings and fieldless searches (#1330) (#1439)

* Add known issues about fieldless searches

* Fix section IDs and cleanup

* Add the known issue to 8.13.3 and 8.13.4

All 8.13.x releases are affected.

* Update docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc

Co-authored-by: David Kilfoyle <[email protected]>

* Apply suggestion from reviewers

---------

Co-authored-by: David Kilfoyle <[email protected]>
(cherry picked from commit f3e0dd1)

Co-authored-by: Maurizio Branca <[email protected]>
Co-authored-by: David Kilfoyle <[email protected]>

Author: 3 people

docs/en/ingest-management/release-notes/release-notes-8.13.asciidoc

@@ -32,6 +32,27 @@ Also see:
 
 There are no bug fixes for {fleet} or {agent} in this release.
 
+[discrete]
+[[known-issues-8.13.4]]
+=== Known issues
+
+[[known-issue-174855-8.13.4]]
+.ECS fields are not included to the `index.query.default_field` in {agent} integrations
+[%collapsible]
+====
+*Details*
+
+Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query).
+
+If you run a query without specifying a field, the query will not return results for ECS fields.
+
+*Impact* +
+
+In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available.
+
+If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57.
+====
+
 // end 8.13.4 relnotes
 
 // begin 8.13.3 relnotes
@@ -48,6 +69,27 @@ Review important information about {fleet-server} and {agent} for the 8.13.3 rel
 {agent}::
 * Update Go version to 1.21.9. {agent-pull}4508[#4508]
 
+[discrete]
+[[known-issues-8.13.3]]
+=== Known issues
+
+[[known-issue-174855-8.13.3]]
+.ECS fields are not included to the `index.query.default_field` in {agent} integrations
+[%collapsible]
+====
+*Details*
+
+Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query).
+
+If you run a query without specifying a field, the query will not return results for ECS fields.
+
+*Impact* +
+
+In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available.
+
+If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57.
+====
+
 [discrete]
 [[bug-fixes-8.13.3]]
 === Bug fixes
@@ -90,6 +132,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul
 
 ====
 
+[[known-issue-174855-8.13.2]]
+.ECS fields are not included to the `index.query.default_field` in {agent} integrations
+[%collapsible]
+====
+*Details*
+
+Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query).
+
+If you run a query without specifying a field, the query will not return results for ECS fields.
+
+*Impact* +
+
+In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available.
+
+If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57.
+====
+
 [discrete]
 [[bug-fixes-8.13.2]]
 === Bug fixes
@@ -127,6 +186,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul
 
 ====
 
+[[known-issue-174855-8.13.1]]
+.ECS fields are not included to the `index.query.default_field` in {agent} integrations
+[%collapsible]
+====
+*Details*
+
+Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query).
+
+If you run a query without specifying a field, the query will not return results for ECS fields.
+
+*Impact* +
+
+In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available.
+
+If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57.
+====
+
 [discrete]
 [[enhancements-8.13.1]]
 === Enhancements
@@ -233,6 +309,23 @@ This issue has been link:https://github.com/elastic/elastic-stack-installers/pul
 
 ====
 
+[[known-issue-174855-8.13.0]]
+.ECS fields are not included to the `index.query.default_field` in {agent} integrations
+[%collapsible]
+====
+*Details*
+
+Due to changes introduced to support the ecs@mappings component template (see link:https://github.com/elastic/kibana/pull/174855[elastic/kibana/pull/174855]), {fleet} no longer includes ECS fields in the integrations' `index.query.default_field`. Not including ECS fields in the `index.query.default_field` setting may affect integrations that rely on fieldless queries (when no field is specified for a query).
+
+If you run a query without specifying a field, the query will not return results for ECS fields.
+
+*Impact* +
+
+In version 8.14.0 and later, {fleet} sets `index.query.default_field` to `*`, so agentless queries will work as expected. We recommend users of {fleet} upgrade to 8.14 when that release becomes available.
+
+If you are running 8.13.x and unable to upgrade to 8.14.0, you can follow the workarounds described in the link:https://support.elastic.co/knowledge/bbdbeb57.
+====
+
 [discrete]
 [[new-features-8.13.0]]
 === New features