Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions docs/changelog/97401.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
pr: 97401
summary: Accept timestamp as object at root level
area: Data streams
type: bug
issues: []
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,7 @@ Test general mockup ECS mappings:
{
"start_timestamp": "not a date",
"start-timestamp": "not a date",
"timestamp.us": 1688550340718000,
"test": "mockup-ecs-log",
"registry": {
"data": {
Expand Down Expand Up @@ -234,6 +235,7 @@ Test general mockup ECS mappings:
"path": "/path/to/my/file",
"target_path": "/path/to/my/file"
},
"code_signature.timestamp": "2023-07-05",
"registry.data.strings": ["C:\\rta\\red_ttp\\bin\\myapp.exe"]
},
"error": {
Expand Down Expand Up @@ -376,6 +378,8 @@ Test general mockup ECS mappings:
- match: { .$idx0name.mappings.properties.start_timestamp.type: "date" }
# testing the default mapping of string input fields to keyword if not matching any pattern
- match: { .$idx0name.mappings.properties.start-timestamp.type: "keyword" }
- match: { .$idx0name.mappings.properties.timestamp.properties.us.type: "long" }
- match: { .$idx0name.mappings.properties.parent.properties.code_signature.properties.timestamp.type: "date" }
- match: { .$idx0name.mappings.properties.vulnerability.properties.score.properties.base.type: "float" }
- match: { .$idx0name.mappings.properties.vulnerability.properties.score.properties.temporal.type: "float" }
- match: { .$idx0name.mappings.properties.vulnerability.properties.score.properties.version.type: "keyword" }
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,6 @@
"type": "date"
},
"path_match": [
"timestamp",
"*.timestamp",
"*_timestamp",
"*.not_after",
Expand Down