The problem

We need to cover some security descriptor changes in Active Directory events (and other use cases that use this field), and with the current dynamic parsing, we cannot search this field as it often contains more than 1024 chars, and if we could, the keyword field type would make us unable to do partial matches efficiently (they need to be case-insensitive).