Currently Kibana Logs UI needs a mechanism to rebuild the original message from events coming from Filebeat modules. This doesn't scale very well, as every time we add/update a new integration, changes need to happen on the Kibana side to support this.

For this reason, in order to provide a good experience, we can change the current behavior of modules to always send the original log line. This would mean:

• Add a new keep_message setting to all modules (default: false). If user configures it to true, do not drop the original message like we do today:

  beats/filebeat/module/nginx/access/ingest/default.json

  Lines 77 to 80 in 1db397d

  	{
  	"remove": {
  	"field": "message"
  	}

• In 8.0 switch the default to true