In Elasticsearch, currently for the `logs-*-*` index template, `default_field: ["message"]` is used. This issue is to discuss the removal of [this setting](https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/template-resources/src/main/resources/logs-settings.json#L10) which means falling back to the default of Elasticsearch which is `default_field: ["*"]`.

In the past there have been issues around using `default_field: ["*"]` for data especially in the context of field explosion. With the introduction of `true_until_limit` (https://github.com/elastic/elasticsearch/pull/96235) this problem will be solved. Instead of users increasing the limit and potentially hit maxClauseCount issue, a soft limit is introduced. More details about what changed in the stack to make this possible can be found [here](https://docs.google.com/document/d/1EA6jeWM1VElGuQwEXzxDZ1hNmVYPCDIGLxU_zl0xeR4/edit).

At first, this would be adopted in the logs template but would expected to eventually make its way into integrations through Fleet. This means logic can be removed to field and will make integrations using dynamice ECS templates work again, see https://github.com/elastic/integrations/issues/7582 for more details.

## Search must always work
 
For a good search experience, it is required that `allow_partial_results: true` is set as otherwise it is possible, that overall search could still fail if a single shard has too many fields inside. It needs to be confirmed in Kibana uses this by default.

## Open question

* Data sink indices: There might be "data sink" indices which might still reach the limit of 1000 fields and a user might want to increase the limit of 1000. It is not clear how a user could do this today or if we need this.
* Breaking change: Could this be considered in any way a breaking change?


## Links


* Dynamic ECS field templates and default_field: https://github.com/elastic/integrations/issues/7582
* [2023-09 Next steps on default fields search](https://docs.google.com/document/d/1EA6jeWM1VElGuQwEXzxDZ1hNmVYPCDIGLxU_zl0xeR4/edit#heading=h.8t1pq71mff4x)
* [Default field docs](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html#index-query-default-field)
* Reference to [default_field message](https://github.com/elastic/elasticsearch/blob/main/x-pack/plugin/core/template-resources/src/main/resources/logs-settings.json#L10)
modules/data-streams/src/javaRestTest/java/org/elasticsearch/datastreams/LogsDataStreamIT.java
"template": {
                    "mappings": {
                      "properties": {
                        "custom_timestamp": {
                          "type": "date"
                        }
                      }
                    }
                  }
                }
                """);
            assertOK(client.performRequest(request));
        }
        {
            Request request = new Request("PUT", "/_ingest/pipeline/logs@custom");
            request.setJsonEntity("""
                    {
                      "processors": [
                        {
                          "set" : {
                            "field": "custom_timestamp",
                            "copy_from": "_ingest.timestamp"
                          }
                        }
                      ]
                    }
                """);
            assertOK(client.performRequest(request));
        }
        String dataStreamName = "logs-generic-default";