Add user_agent.original.text and fix multi_fields support #575
Conversation
Added an original.text field for security use cases which require a wildcard search.
- added the 'fields' section - default norms=false at schema read time for 'text' multi-fields - allow output of 'norms' attribute in the beats yml file
|
Note: I don't think this will make 1.2.0, so no rush. |
| @@ -76,8 +77,15 @@ def render_field_details_row(field): | |||
| example = '' | |||
| if 'example' in field: | |||
| example = "example: `{}`".format(str(field['example'])) | |||
|
|
|||
| field_name_with_mf = field['flat_name'] | |||
There was a problem hiding this comment.
I think we will need to add some more docs to this code or extract it to documented functions. Not required now).
There was a problem hiding this comment.
@ruflin Yes, I would like to have the field set pages be expanded this way eventually:
- Title & description of field set at the top (like now)
- More compact table with short definitions only, and field names are links to a more complete section lower in the page
- Perhaps a "field reuse" section like now, or integrate field reuse directly in this summary table described above
- One linkable section per field name, with more complete details. Using headings for those will allow for the linking, and will also allow for additional information that's currently difficult to capture in the table we have not (should it be an array or a single value?, multi-fields details, deprecation, is the field index:false, etc.)
| if 'group' not in f.keys(): | ||
| # If no group set, set parent group | ||
| f["group"] = group | ||
| # if "multi_fields" in field: |
There was a problem hiding this comment.
Instead of commenting out, can this code be removed?
There was a problem hiding this comment.
Yes, thanks for pointing out.
webmat
force-pushed
the
fix-multi-field-support
branch
from
19cea24 to
e8777cc
Compare
webmat
force-pushed
the
fix-multi-field-support
branch
from
9478e73 to
f8002d9
Compare
|
I'd like to merge this soon and follow up with another PR adding the I've made minor adjustments since your review, @ruflin:
It's important to review how it looks in the docs preview. Prior to today's adjustments it looked like this (no longer the case):
The new format (see preview) is more complete and clearer, but I'm not a big fan. A page redesign is out of the question for this PR, but I'm very much open to suggestions on how we can make this look acceptable in the meantime. cc @rw-access @randomuserid and 🎁 @neu5ron ;-) |
|
Ok, merging this now, as I need to make progress. Please chime in here if this causes issues, and I'll address those in a follow-up PR |
This PR has a dual purpose:
support for them in the generator. After this PR, the multi-fields appear:
Caveat: there isn't full support for setting defaults per type on multi-fields.
The only default being set is setting
norms:falsefortext.