Add GenAI process fields from ECS - #752
Conversation
process.ai_agent.* was documented on Linux process events in #744, but the underlying field/schema definitions were never merged to main — they only made it into the 9.4 backport (#746). Bring the schema generation pieces (ECS ref bump, custom_subsets, fields.yml, schemas/v1) over so main's docs match its schema. (cherry picked from commit f645c16)
| # 43a1a61a4a4db88e2de60da9019733610717ff7e is v8.10.0 | ||
| ECS_GIT_REF ?= 43a1a61a4a4db88e2de60da9019733610717ff7e | ||
| # f04bb41e4fcc35befcaa94a1d9575bc61944520c adds process.ai_agent.* alpha fields. | ||
| ECS_GIT_REF ?= f04bb41e4fcc35befcaa94a1d9575bc61944520c |
There was a problem hiding this comment.
I am not sure if we need to change the ECS ref or not
There was a problem hiding this comment.
1 - yes, this ref will need updating to add these ECS fields
2- CI is not happy about this particular hash:
git -C /buildkite/builds/bk-agent-prod-k8s-1783048298343071251/elastic/endpoint-package/out/ecs checkout f04bb41e4fcc35befcaa94a1d9575bc61944520c
fatal: reference is not a tree: f04bb41e4fcc35befcaa94a1d9575bc61944520c
make: *** [Makefile:120: /buildkite/builds/bk-agent-prod-k8s-1783048298343071251/elastic/endpoint-package/out/ecs/.git/refs/tags/f04bb41e4fcc35befcaa94a1d9575bc61944520c] Error 128
There was a problem hiding this comment.
ECS updates can often pull in a lot of unrelated changes and balloon a PR (and make it harder to backport). Imagine any updates to field descriptions, limits, other added fields get pulled in, etc.
To keep this small, you may want to undo this ecs ref change, and just duplicate the field description, type, etc and copy it into custom_schemas/custom_process.yml.
This should result in the same net change to package/endpoint/data_stream/process/fields/fields.yml after running make. This is the actual file that gets imported and parsed in kibana to create the mappings, so defining this in custom_schemas, to get the same end result, is a-ok.
There was a problem hiding this comment.
done, waiting for CI now
pzl
left a comment
pzl
left a comment
There was a problem hiding this comment.
yes, this approach will work
you may have to battle with make to ensure it generates the changes in the package/endpoint/docs/README.md file, add and commit that
but you're good to merge if you can get CI passing
|
Thanks! |
4 participants
process.ai_agent.* was documented on Linux process events in #744, but the underlying field/schema definitions were never merged to main - here they are
(cherry picked from commit f645c16)
Change Summary
Sample values
Sample document:
Release Target
Q/A
For mapping changes:
makeafter making the schema changes, and committed all changesmetadatachange, I also updated both transform destination schemas to matchFor Transform changes: