Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generator does not add "ignore_above" property for field type: flattened #2237

Closed
brett-fitz opened this issue Jul 20, 2023 · 0 comments · Fixed by #2248
Closed

Generator does not add "ignore_above" property for field type: flattened #2237

brett-fitz opened this issue Jul 20, 2023 · 0 comments · Fixed by #2248
Labels
bug Something isn't working

Comments

@brett-fitz
Copy link
Contributor

brett-fitz commented Jul 20, 2023

Description of the problem including expected versus actual behavior:
Generator does not write the property: ignore_above for field type: flattened

Steps to reproduce:

Create a field in a field set that is flattened with the ignore above key

    - name: enrichment_data
      level: custom
      type: flattened
      description: >-
        Flattened object of enrichment data.
      ignore_above: 1024

Please include a minimal but complete recreation of the problem.

  1. Created field set ecs file
  2. Added field set to subset.yml
  3. Generated artifacts
  4. Examine generated component template with flattened field.

Provide logs (if relevant):

Generated component template

{
  "_meta": {
    "ecs_version": "8.8.0"
  },
  "template": {
    "mappings": {
      "properties": {
        "enrichment_data": {
          "type": "flattened"
        }
      }
    }
  }
}

Any additional context:
This key is necessary so elasticsearch does not try to index fields with large values.

Note: Adding the property after the component template is generated works as a temporary workaround.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant