Moving from keyword only indexing to multi-fields is a breaking change, so we need to make sure we're consistent with this.

• Review all current textual fields with an open mind and consider if they could benefit from being multi-field.
  • Since we currently do keyword by default, the question will mostly be: would we benefit from the ability to do partial searches on these values? E.g. filter for "guest" or "wifi" in field network.name or "prod" in host.name.
• Document this as an ECS convention: we consider doing multi-fields on any non-trivial text field.