[1.5] registry.data.strings field missing array definition?

[codebrain]

It looks like re-running the ECS .NET generator has picked up a change to registry.data.strings.

In 1.4.0 it was manually overridden to emit a string[] type but is now emitting string type as the field has no normalize->array definition.

The description for this property reads as:

Content when writing string types.Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g "1").

https://github.com/elastic/ecs-dotnet/blob/8cfe5f6c5661427204e42891ede4d8fcc8889231/src/Elastic.CommonSchema/Types.Generated.cs#L3514

Should this be modelled as an array? I was also wondering if it would be equally valid for this to be a Union<string[], decimal>?

[webmat]

Should this be modelled as an array? I was also wondering if it would be equally valid for this to be a Union<string[], decimal>?

I'm not familiar enough with C# to know what this is. Does it mean "either an array of strings or a single decimal"?

I think the format in C# should be an array of strings all the time. It's a keyword field in Elasticsearch.

[codebrain]

I'm not familiar enough with C# to know what this is. Does it mean "either an array of strings or a single decimal"?

Yes.

We can put the decimal value in as a string, no problem.