[9.0] Add support for flattened fields with ignore_above in mappings (#238890)

x-pack/platform/plugins/shared/fleet/server/services/epm/elasticsearch/template/template.test.ts

@@ -1829,11 +1829,32 @@ describe('EPM template', () => {
   type: object
   object_type: constant_keyword
 `;
-    const fields: Field[] = load(textWithRuntimeFieldsLiteralYml);
-    expect(() => {
+      const fields: Field[] = load(textWithRuntimeFieldsLiteralYml);
+      expect(() => {
+        const processedFields = processFields(fields);
+        generateMappings(processedFields);
+      }).toThrow();
+    });
+
+    it('tests processing flattened field with ignore_above 1024', () => {
+      const flattenedFieldYml = `
+- name: flattenedField
+  type: flattened
+  ignore_above: 1024
+`;
+      const flattenedFieldMapping = {
+        properties: {
+          flattenedField: {
+            type: 'flattened',
+            ignore_above: 1024,
+          },
+        },
+      };
+      const fields: Field[] = load(flattenedFieldYml);
       const processedFields = processFields(fields);
-      generateMappings(processedFields);
-    }).toThrow();
+      const mappings = generateMappings(processedFields);
+      expect(mappings).toEqual(flattenedFieldMapping);
+    });
   });
 
   it('tests priority and index pattern for data stream without dataset_is_prefix', () => {

x-pack/platform/plugins/shared/fleet/server/services/epm/elasticsearch/template/template.ts

@@ -612,6 +612,12 @@ function _generateMappings(
               type: 'aggregate_metric_double',
             };
             break;
+          case 'flattened':
+            fieldProps.type = type;
+            if (field.ignore_above) {
+              fieldProps.ignore_above = field.ignore_above;
+            }
+            break;
           default:
             fieldProps.type = type;
         }