-
Notifications
You must be signed in to change notification settings - Fork 67
/
fields.spec.yml
360 lines (322 loc) · 11.6 KB
/
fields.spec.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
##
## Describes the specification for a data stream's various field definition files
##
spec:
# Everything under here follows JSON schema (https://json-schema.org/), written as YAML for readability
type: array
items:
type: object
additionalProperties: false
patternProperties:
# Soft validation on some properties that can be present but not validated or used yet.
"^(level|group)$":
anyOf:
- type: string
- type: integer
"^(footnote|format|title)$":
type: string
"^(default_field|norms)$":
type: boolean
properties:
name:
description: >
Name of field. Names containing dots are automatically split into
sub-fields.
type: string
pattern: '^[\-*_\/@A-Za-z0-9]+(\.[\-*_\/@A-Za-z0-9]+)*$'
type:
description: Datatype of field
type: string
enum:
- alias
- histogram
- constant_keyword
- text
- match_only_text
- keyword
- long
- integer # Fleet always maps this as 'long'.
- short
- byte
- double
- float
- half_float
- scaled_float
- date
- date_nanos
- boolean
- binary
- integer_range
- float_range
- long_range
- double_range
- date_range
- ip_range
- group
- geo_point
- object
- ip
- nested
- flattened
- wildcard
- version
- unsigned_long
description:
description: Short description of field
type: string
value:
description: The value to associate with a constant_keyword field.
type: string
example:
description: Example values for this field.
anyOf:
- type: string
- type: number
- type: boolean
- type: "null"
- type: array
items:
anyOf:
- type: string
- type: number
- type: boolean
- type: object
additionalProperties: true
metric_type:
description: >
The metric type of a numeric field. This is attached to the
field as a `time_series_metric` mapping parameter. A gauge is a
single-value measurement that can go up or down over time, such as a
temperature. A counter is a single-value cumulative counter that only
goes up, such as the number of requests processed by a web server. By
default, no metric type is associated with a field.
type: string
enum:
- counter
- gauge
unit:
description: >
Unit type to associate with a numeric field. This is attached to the
field as metadata (via `meta`). By default, a field does not have a
unit. The convention for percents is to use value 1 to mean 100%.
type: string
enum:
- byte
- percent
- d
- h
- m
- s
- ms
- micros
- nanos
dimension:
description: >
Declare a field as dimension of time series. This is
attached to the field as a `time_series_dimension` mapping parameter.
type: boolean
default: false
pattern:
description: >
Regular expression pattern matching the allowed values for the field.
This is used for development-time data validation.
type: string
examples:
- '^[a-zA-Z]$'
external:
description: External source reference
type: string
enum:
- ecs
fields:
description: Sub-fields, when type is group
$ref: "#" # JSON-schema syntax for pointing to the root of the schema
doc_values:
description: >
Controls whether doc values are enabled for a field. All fields which
support doc values have them enabled by default. If you are sure that
you don’t need to sort or aggregate on a field, or access the field
value from a script, you can disable doc values in order to save disk
space. You cannot disable doc values for wildcard fields.
type: boolean
index:
description: >
The index option controls whether field values are indexed. Fields
that are not indexed are typically not queryable.
type: boolean
default: true
copy_to:
description: >
The copy_to parameter allows you to copy the values of multiple fields
into a group field, which can then be queried as a single field.
type: string
enabled:
description: >
The enabled setting, which can be applied only to the top-level
mapping definition and to object fields, causes Elasticsearch to skip
parsing of the contents of the field entirely. The JSON can still be
retrieved from the _source field, but it is not searchable or stored
in any other way.
type: boolean
dynamic:
description: >
The dynamic parameter controls whether new fields are added
dynamically. It accepts the following values:
true - New fields are added to the mapping (default).
runtime - New fields are added to the mapping as runtime fields. These
fields are not indexed, and are loaded from _source at query time.
false - New fields are ignored. These fields will not be indexed or
searchable, but will still appear in the _source field of returned
hits. These fields will not be added to the mapping, and new fields
must be added explicitly.
strict - If new fields are detected, an exception is thrown and the
document is rejected. New fields must be explicitly added to the
mapping.
default: true
enum:
- true
- false
- strict
- runtime # Not supported at this time by Fleet.
scaling_factor:
description: >
The scaling factor to use when encoding values. Values will be
multiplied by this factor at index time and rounded to the closest
long value. For instance, a scaled_float with a scaling_factor of 10
would internally store 2.34 as 23 and all search-time operations
(queries, aggregations, sorting) will behave as if the document had a
value of 2.3. High values of scaling_factor improve accuracy but also
increase space requirements. Only valid for 'type: scaled_float'.
type: integer
default: 1000
analyzer:
description: >
Name of the analyzer to use for indexing. Unless search_analyzer is
specified this analyzer is used for both indexing and searching.
Only valid for 'type: text'.
type: string
search_analyzer:
description: >
Name of the analyzer to use for searching. Only valid for 'type: text'.
type: string
multi_fields:
description: >
It is often useful to index the same field in different ways for
different purposes. This is the purpose of multi-fields. For instance,
a string field could be mapped as a text field for full-text search,
and as a keyword field for sorting or aggregations.
Fleet honors this for `keyword`, `text`, and `wildcard` types.
$ref: "#" # JSON-schema syntax for pointing to the root of the schema
null_value:
description: >
The null_value parameter allows you to replace explicit null values
with the specified value so that it can be indexed and searched.
A null value cannot be indexed or searched. When a field is set to
null, (or an empty array or an array of null values) it is treated as
though that field has no values.
The null_value needs to be the same data type as the field. For
instance, a long field cannot have a string null_value.
The null_value only influences how data is indexed, it doesn’t modify
the _source document.
examples:
- "NULL"
ignore_above:
description: >
Strings longer than the ignore_above setting will not be indexed or
stored. For arrays of strings, ignore_above will be applied for each
array element separately and string elements longer than ignore_above
will not be indexed or stored. Fleet honors this for `keyword` and
`wildcard` types. Defaults to 1024.
type: integer
default: 1024
object_type:
description: >
Type of the members of the object when `type: object` is used. In
these cases a dynamic template is created so direct subobjects of
this field have the type indicated.
When `object_type_mapping_type` is also used, the dynamic mapping is
only applied to values that have the given type, as detected by the
JSON parser.
type: string
enum:
- boolean
- byte
- double
- float
- histogram
- keyword
- long
- object
- short
- text
object_type_mapping_type:
description: >
Type that members of a field of with `type: object` must have in the
source document.
This type corresponds to the data type detected by the JSON parser,
and is translated to the `match_mapping_type` parameter of
Elasticsearch dynamic templates.
type: string
enum:
- '*'
- array
- double
- 'false'
- long
- 'null'
- object
- string
- 'true'
path:
description: >
For alias type fields this is the path to the target field. Note that
this must be the full path, including any parent objects
(e.g. object1.object2.field).
type: string
normalize:
description: >
Specifies the expected normalizations for a field.
`array` normalization implies that the values in the field should always be
an array, even if they are single values.
type: array
items:
type: string
enum:
- array
normalizer:
description: >
Specifies the name of a normalizer to apply to keyword fields. A
simple normalizer called lowercase ships with elasticsearch and can be
used. Custom normalizers can be defined as part of analysis index
settings.
type: string
include_in_parent:
description: >
For nested field types, this specifies if all fields in the nested
object are also added to the parent document as standard (flat)
fields.
type: boolean
default: false
include_in_root:
description: >
For nested field types, this specifies if all fields in the nested
object are also added to the root document as standard (flat)
fields.
type: boolean
default: false
required:
- name
versions:
- before: 2.0.0
patch:
- op: add
path: "/items/properties/type/enum/29"
value: "array"
- op: replace
path: "/items/additionalProperties"
value: true
- op: remove
path: "/items/patternProperties"
value: true
- op: remove
path: "/items/properties/example"