Elasticsearch default_fields has a default limit of 1024 fields, the limit is not enforced when we created the template but it will be returned when we query Elasticsearch through Kibana.

Recently master was broken because new fields were added and we didn't detect it right away.
@andrewkroh has fixed the issues and removed unnecessary fields and added a test to make sure we don't go over.

But we are on borrowed time here until we change our template strategy because we are at 939 field now. The unit test will allow to be notified up front but we should add a new integration test to make sure that the default value of Elasticsearch is not changed to something else.

Scenario:

• Add a test to test_based.py so all the existing beats can run it.
• Start the beats
• Install the template
• Do an Elasticsearch query to see if we still have the problem.

See #14262 for a description of the behavior when it fails.