github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 09:48:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Rule Registry] Remove constant_keyword field mappings from ECS component template (#123486)

Browse source 
* Remove constant_keyword field mappings from ECS component template

These ECS fields are meant for specific indices (datastreams), but do
not make sense (especially as `constant_keyword`) on our alerts-as-data
indices, as they will cause errors when attempting to ingest different
values from different indices.

* Filter out constant_keyword fields from ECS fieldmap

The results of this were already applied to the fields themselves, but
this ensures that the script does not accidentally repopulate them in
the future.

Implementation-wise, it was simpler to refactor this into a reduce()
rather than explicitly using filter() and then generating a new object.
This commit is contained in:
Ryland Herrick 2022-01-20 12:36:41 -06:00 • committed by GitHub
parent d744500c24
commit ee34a7a694
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

15
x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
View file

@ -415,21 +415,6 @@ export const ecsFieldMap = {
array: false,
required: false,
},
'data_stream.dataset': {
type: 'constant_keyword',
array: false,
required: false,
},
'data_stream.namespace': {
type: 'constant_keyword',
array: false,
required: false,
},
'data_stream.type': {
type: 'constant_keyword',
array: false,
required: false,
},
'destination.address': {
type: 'keyword',
array: false,

32
x-pack/plugins/rule_registry/scripts/generate_ecs_fieldmap/index.js
View file

@ -9,7 +9,7 @@ const fs = require('fs');
const util = require('util');
const yaml = require('js-yaml');
const { exec: execCb } = require('child_process');
const { mapValues } = require('lodash');
const { reduce } = require('lodash');
const exists = util.promisify(fs.exists);
const readFile = util.promisify(fs.readFile);
@ -32,19 +32,27 @@ async function generate() {
const flatYaml = await yaml.safeLoad(await readFile(ecsYamlFilename));
const fields = mapValues(flatYaml, (description) => {
const field = {
type: description.type,
array: description.normalize.includes('array'),
required: !!description.required,
};
const fields = reduce(
flatYaml,
(fieldsObj, value, key) => {
const field = {
type: value.type,
array: value.normalize.includes('array'),
required: !!value.required,
};
if (description.scaling_factor) {
field.scaling_factor = description.scaling_factor;
}
if (value.scaling_factor) {
field.scaling_factor = value.scaling_factor;
}
return field;
});
if (field.type !== 'constant_keyword') {
fieldsObj[key] = field;
}
return fieldsObj;
},
{}
);
await Promise.all([
writeFile(