-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ensure that match_only_text and wildcard fields can be added to default_field list #29634
Conversation
This pull request does not have a backport label. Could you fix it @adriansr? 🙏
NOTE: |
Pinging @elastic/security-external-integrations (Team:Security-External Integrations) |
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
💚 Flaky test reportTests succeeded. 🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
After seeing this I wonder if wildcard should be in that case too?
Makes sense. Added |
What does this PR do?
Fixes the construction of the index template's
default_field
list so that fields of type match_only_text and wildcard can be added to it.Why is it important?
Since support for match_only_text type was introduced in Beats, important fields where missing from the
default_field
index template setting. This affected themessage
field among others.Note: this PR only completely fixes the issue for the 7.16 branch, as another (unrelated) feature in 8.0/master also broke
default_field
. See #29633.Checklist
[ ] I have made corresponding changes to the documentation[ ] I have made corresponding change to the default configuration filesCHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.Related issues