propose nested objects for tracking email address with display name

rfcs/text/0010-email.md

@@ -19,10 +19,16 @@ Stage 1: Describe at a high level how this change affects fields. Which fieldset
 | `email.from` | keyword | Stores the `from` email address from the RFC5322 `From:` header field. |
 | `email.origination_timestamp` | date | The date and time the email message was composed. Many email clients will fill this in automatically when the message is sent by a user. |
 | `email.delivery_timestamp` | date | The date and time the email message was received by the service or client. |
-| `email.to` | keyword (array) | The email address(es) of the message recipient(s) |
+| `email.to` | nested | Nested object with the message recipient(s) |
+| `email.to.address` | keyword | The email address of message recipient |
+| `email.to.display_name` | keyword | The display name of message recipient |
 | `email.subject` | keyword; `.text` text multi-field | A brief summary of the topic of the message |
-| `email.cc` | keyword (array) | The email address(es) of the carbon copy (CC) recipient(s) |
-| `email.bcc` | keyword (array) | The email address(es) of the blind carbon copy (CC) recipient(s) |
+| `email.cc` | nested | Nested object with the carbon copy (CC) recipient(s) |
+| `email.cc.address` | keyword | The email address of a carbon copy (CC) recipient |
+| `email.cc.display_name` | keyword | The display name of carbon copy (CC) recipient |
+| `email.bcc` | nested | Nested object with the blind carbon copy (CC) recipient(s) |
+| `email.bcc.address` | keyword | The email address of the blind carbon copy (CC) recipient(s) |
+| `email.bcc.display_name` | keyword | The display name of the blind carbon copy (CC) recipient(s) |
 | `email.content_type` | keyword | Information about how the message is to be displayed. Typically a MIME type |
 | `email.message_id` | wildcard | Identifier from the RFC5322 `Message-ID:` header field that refers to a particular version of a particular message. |
 | `email.local_id` | keyword | Unique identifier given to the email by the source (MTA, gateway, etc.) that created the event and is not persistent across hops (for example, the `X-MS-Exchange-Organization-Network-Message-Id` id). |

rfcs/text/0010/email.yml

@@ -17,6 +17,9 @@
  description: >
  A list of attachment files sent along with an email message.
 
+ normalize:
+ - array
+
  - name: attachments.file.extension
  level: extended
  type: keyword
@@ -78,25 +81,64 @@
  - name: bcc
  level: extended
  type: keyword
- short: Email address(es) of BCC recipients
+ short: BCC recipients
  description: >
  The email address(es) of the blind carbon carbon (BCC) recipients.
  example: "['[email protected]', '[email protected]']"
 
  normalize:
  - array
 
- - name: cc
+ - name: bcc
+ level: extended
+ type: nested
+ short: List of objects describing BCC recipients
+ description: >
+ The email address(es) of the blind carbon carbon (BCC) recipients.
+ normalize:
+ - array
+
+ - name: bcc.address
  level: extended
  type: keyword
- short: Email address(es) of CC recipients
+ short: Email address of BCC recipient
  description: >
- The email address(es) of the carbon carbon (BCC) recipients.
- example: "['[email protected]', '[email protected]']"
+ The email address of BCC recipient
+ example: "[email protected]"
+
+ - name: bcc.display_name
+ level: extended
+ type: keyword
+ short: Display name of BCC recipient
+ description: >
+ The display name of the BCC recipient
+ example: "BCC User"
 
+ - name: cc
+ level: extended
+ type: nested
+ short: List of objects describing CC recipients
+ description: >
+ The email address(es) of the carbon carbon (BCC) recipients.
  normalize:
  - array
 
+ - name: cc.address
+ level: extended
+ type: keyword
+ short: Email address of CC recipient
+ description: >
+ The email address of CC recipient
+ example: "[email protected]"
+
+ - name: cc.display_name
+ level: extended
+ type: keyword
+ short: Display name of CC recipient
+ description: >
+ The display name of CC recipient
+ example: "CC User"
+
  - name: content_type
  level: extended
  type: keyword
@@ -180,15 +222,29 @@
 
  - name: to
  level: extended
- type: keyword
- short: Email address(es) of the recipients.
+ type: nested
+ short: List of objects describing recipients.
  description: >
- The email address(es) of the message recipients.
- example: "['[email protected]', '[email protected]']"
-
+ The email addresses of message recipients.
  normalize:
  - array
 
+ - name: to.address
+ level: extended
+ type: keyword
+ short: Email address of recipient
+ description: >
+ The email address of recipient
+ example: "[email protected]"
+
+ - name: to.display_name
+ level: extended
+ type: keyword
+ short: Display name of recipient
+ description: >
+ The display name of recipient
+ example: "Example User"
+
  - name: x_mailer
  level: extended
  type: keyword