[cloud_security_posture] Update index template mapping #3248
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Test stats 🧪
🤖 GitHub commentsTo re-run your PR in the CI, just comment with:
|
🌐 Coverage report
|
|
/test |
packages/cloud_security_posture/data_stream/findings/fields/findings.yml
Show resolved
Hide resolved
| - name: name | ||
| type: text | ||
| ignore_above: 1024 | ||
| - name: sub_type |
There was a problem hiding this comment.
shouldn't subtype be keyword?
There was a problem hiding this comment.
shouldn't subtype be keyword?
I thought the user might want to search for a partial sub_type and get results.
For example, search for Controller and get data about ReplicationController | DeploymentController
Anyway, I used multi-fields which should index the field as text & keyword - multi-fields
There was a problem hiding this comment.
One of the conventions in ECS (and most integrations) is to use .text as the multi-field rather than .keyword. See https://www.elastic.co/guide/en/ecs/8.2/ecs-conventions.html#_ecs_convention_for_indexing_text_fields for an explanation. Just want to mention this in case there is still an opportunity to align with this convention.
| @@ -10,6 +10,7 @@ | |||
| - name: keyword | |||
| type: keyword | |||
| ignore_above: 1024 | |||
| # deprecated - the new field is under the resource obj | |||
There was a problem hiding this comment.
it's not clear which field are you referring here.
please add this comment to both type and resource_id
andrewkroh
changed the title
What does this PR do?
Checklist
changelog.ymlfile.Author's Checklist
How to test this PR locally
Install the integration and verify ES is able to index the cloudbeat events according to the new mapping.
Related issues
Screenshots