Revisit maxLength=1024 restrictions on Intake API

We should follow current conversations around increasing or removing the `ignore_above=1024` restrictions on ECS on keywords (https://github.com/elastic/ecs/issues/105). If ECS and libbeat (https://github.com/elastic/beats/blob/master/libbeat/_meta/fields.ecs.yml#L51) change the limitations, we should make use of that and also revisit the limitations on the intake API.

Start by following the linked ECS issue and reviewing libbeat/_meta/fields.ecs.yml at line 51 to determine whether the keyword length limitation has changed. Then inspect the Intake API restrictions and update them only if ECS and libbeat support increased or removed limits; done means the API follows the agreed upstream limitation.

Written by the indexing model from the issue text.