Added call_stack_contains_unbacked field

[bit-envoy]

Change Summary

Schema changes related to https://github.com/elastic/endpoint-dev/pull/11979

Release Target

8.6.0

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-11-08T16:41:32.798+0000

• Duration: 8 min 39 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[jdu2600]

I believe that you just need to add it under thread.Ext something like this -

endpoint-package/custom_schemas/custom_process.yml

Lines 104 to 106 in c2d8f90

	- name: thread.Ext.call_stack_summary
	level: custom
	type: keyword

And these earlier lines handle making reusable and it valid at locations like Target.process.parent.thread.Ext -

endpoint-package/custom_schemas/custom_process.yml

Lines 12 to 16 in c2d8f90

	reusable:
	top_level: true
	expected:
	- Target
	- { at: Target.process, as: parent }

[bit-envoy]

I believe that you just need to add it under thread.Ext something like this -

endpoint-package/custom_schemas/custom_process.yml

Lines 104 to 106 in c2d8f90

	- name: thread.Ext.call_stack_summary
	level: custom
	type: keyword

And these earlier lines handle making reusable and it valid at locations like Target.process.parent.thread.Ext -

endpoint-package/custom_schemas/custom_process.yml

Lines 12 to 16 in c2d8f90

	reusable:
	top_level: true
	expected:
	- Target
	- { at: Target.process, as: parent }

Fixed, thanks.

[kevinlog]

@bit-envoy

Thanks for opening this PR! There are a few things to make sure you do in order to get a green build on this.

1. You've added a new field to custom_schemas, but you need to make sure you add it to custom_subsets. Based on the README change here, it looks like this is to be a new field in alerts. You likely need to make a change to one of the custom_subsets here
2. After you make the changes, run make to ensure the same changes show up in package/endpoint/data_stream. Your make will add fields to alerts data_stream I am assuming. Be sure to commit these changes in your PR.
3. Add sample data for your change here, package/endpoint/data_stream/<streamname>/sample_event.json. This helps us document the intent behind package changes. In addition, after you update with sample data, CI will effectively use it as a unit test and check to see that the sample data you add matches the mapping changes you make.

I think this recent change has examples of what's described above.

Let me know of any questions you have

[bit-envoy]

Thanks @kevinlog for tips. I have updated custom_subsets, ran make successfully, but it seems there are still some errors on build. I don't see why. Also when I ran make it does not add anything to data_stream. I added changes manually. Is there any clear indication what files should be edited manually and what files should be generated?

[kevinlog]

@bit-envoy

I have updated custom_subsets, ran make successfully, but it seems there are still some errors on build. I don't see why. Also when I ran make it does not add anything to data_stream.

I'll check out your PR and take a look to see if I see anything

[kevinlog]

LGTM - thanks for the changes!

[elasticmachine]

Package endpoint - 8.6.0 containing this change is available at https://epr.elastic.co