_Do Not Merge until we got approval from breaking changes committee _
This PR should not backport to 8.x

Release notes

Removed the --event_api.tags.illegal flag, which allowed setting non string values to the tags field. Since v9, such illegal assignments will fail, resulting in a _tagsparsefailure in the tags field, and the illegal value will be written to the _tags field.

What does this PR do?

The commit removes the --event_api.tags.illegal option which is added in #14822

Why is it important/What is the impact to the user?

This is a breaking change. User no longer be able to set event_api.tags.illegal to warn as a fallback to accept the illegal assignment of tags field.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files (and/or docker env variables)
• I have added tests that prove my fix is effective or that my feature works

Author's Checklist

• run with --event_api.tags.illegal warn throws Unrecognised option
• illegal assignment is written to _tags

How to test this PR locally

1. bin/logstash -f /path/to/p.conf --event_api.tags.illegal warn should give Unrecognised option
2. Happy case

input {
    generator {
      count=> 1
      message => '{"tags": ["a","b"] }'
      codec => json
    }
}

output {
    stdout {}
}

It is valid tags and should give no error

3. Sad case

input {
    generator {
      count=> 1
      message => '{"tags": {"poison":true}}'
      codec => json
    }
}

output {
    stdout {}
}

It is invalid tags and should give _tagsparsefailure

Related issues

• Fixes: Remove event_api.tags.illegal (default becomes locked to 'rename') #16356
• relates: add deprecation log for --event_api.tags.illegal #16507

Use cases

Screenshots

Logs