Consider using doc_values for tags field

[lukas-vlcek]

Currently, the _default_ mapping specification disables doc_values for tags field. I think we should consider enabling it but it will require a bit of discussion and can introduce breaking change.

    # existing ES 2.x notation
    - name: tags
      type: string
      doc_values: false
      index: analyzed
      analyzer: whitespace
      description: >
        Optionally provided operator defined list of tags placed on each log
        by the collector or normalizer. The payload can be a string with
        whitespace-delimited string tokens, or a JSON list of string tokens.

Relevant read: https://www.elastic.co/guide/en/elasticsearch/reference/5.5/doc-values.html

Pros:

• more efficient aggregations and sorting (I guess tags field is a good candidate to aggregate on)

Cons:

• not possible on analyzed string which means users will be able to provide multiple tags only via an array, like: "tags": ["foo", "bar"] and no whitespace analyzer will be run on the content of individual values.