Make command.action.args type object instead of keyword type value

[f-galland]

Description

This PR changes command.action.args from the .commands index template from keyword into object to accommodate for various data types, including arrays.

Related Issues

Resolves #618

Check List

• Functionality includes testing.
• API changes companion pull request created, if applicable.
• Public documentation issue/PR created, if applicable.

[f-galland]

Generating the mapping:

(env) fede@tyner:~/src/ecs ((ce2e1da5...))
$ ./generate.sh v8.11.0 ~/src/wazuh-indexer command
Loading schemas from git ref v8.11.0
Running generator. ECS version 8.11.0
Loading user defined schemas: ['/home/fede/src/wazuh-indexer/ecs/command/fields/custom/']
Replacing "constant_keyword" type with "keyword"
Replacing "wildcard" type with "keyword"
Replacing "match_only_text" type with "keyword"
Replacing "flattened" type with "flat_object"
Replacing "scaled_float" type with "float"
Removing scaling_factor lines
Deleting the "tags" field from the index template
Removing multi-fields from the index template
Mappings saved to /home/fede/src/wazuh-indexer/ecs/command/mappings/v8.11.0

command.action.args is of the right type:

(env) fede@tyner:~/src/wazuh-indexer/ecs/command/mappings/v8.11.0/generated/elasticsearch/legacy (master)
$ jq .mappings.properties.command.properties.action.properties.args template.json 
{
  "type": "object"
}

Template push is acknowledged:

(env) fede@tyner:~/src/wazuh-indexer/ecs/command/mappings/v8.11.0/generated/elasticsearch/legacy (master)
$ curl -sku admin:admin -XPUT https://192.168.60.30:9200/_template/index-template-commands -H "Content-Type: application/json" -d $(jq . template.json -c)
{"acknowledged":true}

Writing different types of data works as intended:

(env) fede@tyner:~/src/wazuh-indexer/ecs/command/mappings/v8.11.0/generated/elasticsearch/legacy (master)
$ curl -sku admin:admin -XPUT https://192.168.60.30:9200/_template/index-template-commands -H "Content-Type: application/json" -d $(jq . template.json -c)
curl -sku admin:admin -XPOST https://192.168.60.30:9200/.commands/_doc -H "Content-Type: application/json" -d '{"command": {"action": {"args": "test"}}}'

(env) fede@tyner:~/src/wazuh-indexer/ecs/command/mappings/v8.11.0/generated/elasticsearch/legacy (master)
$ curl -sku admin:admin -XPOST https://192.168.60.30:9200/.commands/_doc -H "Content-Type: application/json" -d '{"command": {"action": {"args": ["one","two","three"]}}}'
{"_index":".commands","_id":"z8lFRpQB3d5DUA5N-Eiv","_version":1,"result":"created","_shards":{"total":1,"successful":1,"failed":0},"_seq_no":228853,"_primary_term":15}

[AlexRuiz7]

There are some things missing in order to consider the issue ready to review. Refer to the Plan described in the issue.

• Update index model and documentation.
• Update index template on the setup plugin and tooling.
• Update Management API commands (orders) schema.
• Update Agent commands (orders) schema.