mirror of
https://github.com/elastic/kibana.git
synced 2025-06-27 18:51:07 -04:00
[Response Ops] [Alerting] Excluding ECS fields of type constant_keyword
from ECS field map (#155075)
Fields mapped as `constant_keyword` can cause issues when used in the alerts as data mapping where multiple types of sources are combined into one index. These fields were previously excluded from the ECS field mapping used by alerts as data. We included them because we wanted to use ECS as closely as possible but it is causing downstream issues so we'll continue excluding them until we decide we need them at some point in the future. ## To verify: 1. Start ES & Kibana 2. Inspect the `.alerts-ecs-mappings` component template mapping and verify there are no fields with type `constant_keyword`
This commit is contained in:
parent
153994d810
commit
5a818176ef
1 changed files with 8 additions and 0 deletions
|
@ -9,8 +9,16 @@
|
|||
import { EcsFlat } from '@kbn/ecs';
|
||||
import { EcsMetadata, FieldMap } from './types';
|
||||
|
||||
const EXCLUDED_TYPES = ['constant_keyword'];
|
||||
|
||||
export const ecsFieldMap: FieldMap = Object.keys(EcsFlat).reduce((acc, currKey) => {
|
||||
const value: EcsMetadata = EcsFlat[currKey as keyof typeof EcsFlat];
|
||||
|
||||
// Exclude excluded types
|
||||
if (EXCLUDED_TYPES.includes(value.type)) {
|
||||
return acc;
|
||||
}
|
||||
|
||||
return {
|
||||
...acc,
|
||||
[currKey]: {
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue