Add dynamic mappings for non-indexed ECS fields #1733
Conversation
|
/test integrations |
|
test integrations |
|
Created or updated PR in integrations repository to test this version. Check elastic/integrations#9406 |
|
test integrations |
|
Created or updated PR in integrations repository to test this version. Check elastic/integrations#9406 |
| type: keyword | ||
| index: false | ||
| doc_values: false | ||
| path_match: 'event.original' |
There was a problem hiding this comment.
If we just apply these changes here, rebuilding current packages will give different results. So I think we may need to include them only after something is updated in the package. I see two options for this:
- Use the ECS version set in
_dev/build/build.yml. This would allow us to introduce the change in the same version as in Elasticsearch (Add non-indexed fields to ecs templates elasticsearch#106714). - Use a Package Spec version, as we do with other features.
Or we can just go on and apply it to existing packages if rebuilt, as this can be considered a fix, even if it breaks a bit of reproducibility.
@ruflin @flash1293 @mrodm thoughts?
There was a problem hiding this comment.
I don't think users will insist on this level of reproducibility - it's unlikely anyone actually relied on this behavior and by not requiring the integration author to jump through hoops, we make it easier for this fix to get adopted.
There was a problem hiding this comment.
Looking into this it would be great that it would be easy for owners to get this fix in their packages without any change (e.g. updating package-spec version) to not force to more changes (e.g. new validation rules).
So, it looks ok to me if this applied as it is too.
|
/test |
💔 Build Failed
Failed CI StepsHistory
cc @jsoriano |
|
Unrelated failures in benchmarks. |
5 participants
Proposal to add dynamic mappings for non-indexed ECS fields.
This is needed for some fields like
event.originalthat are documented and defined in ECS as non-indexed, withindex: falseanddoc_values: false.