[Filebeat] [Doc] Metricbeat host namespace causes mapping conflict when used with Logstash

[jkelastic]

Need to add the following to the breaking changes part of the Filebeat / Logstash docs

Metricbeat host namespace causes mapping conflict when used with Logstash

For confirmed bugs, please report:

• Version: Filebeat and Logstash 6.3
• Github Link Metricbeat host namespace causes mapping conflict when used with Logstash #7050

After upgrade to 6.3.0, some logsources will cause an error in logstash and will not make it to elasticsearch. 

The error: 
[2018-06-15T22:22:53,246][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"logstash-2018.06.15", :_type=>"doc", :_routing=>nil}, #<LogStash::Event:0x5b4f0227>], :response=>{"index"=>{"_index"=>"logstash-2018.06.15", "_type"=>"doc", "_id"=>"rg0dBWQB0H0urKNSctIj", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:620"}}}}}

[andrewkroh]

To clarify, I think you are proposing to have it listed on a new "Breaking Changes in 6.3" page linked from here. Correct?

It is listed as a breaking change in the release notes.

[ppf2]

+1. Users generally go to breaking changes for breaking changes and may miss them in release notes.
For this particular one, I will suggest not only highlight it in breaking changes, but also provide a list of potential workarounds to address the field conflicting type issue.

[jkelastic]

@andrewkroh yes, please also include it in the breaking changes as customer don't read the release notes.

[dedemorton]

Added a first draft of the breaking change docs here: #7398