---
- name: log
    - name: original
      short: Deprecated Original log message with light interpretation only (encoding, newlines).
      description: >
        Deprecated for Removal in next major version release. This field is superceeded by
        `event.original`

        This is the original log message and contains the full log message
        before splitting it up in multiple parts.

        In contrast to the `message` field which can contain an extracted part
        of the log message, this field contains the original, full log message.
        It can have already some modifications applied like encoding or new
        lines removed to clean up the log message.

        This field is not indexed and doc_values are disabled so it can't be
        queried but the value can be retrieved from `_source`.