[auditd_manager] Update fields and sample_event.json #12541
Conversation
| - name: auditd.data.* | ||
| description: Auditd related data | ||
| type: flattened | ||
| type: keyword |
There was a problem hiding this comment.
If this field is declared as flattened, this is not created as mapping currently.
Probably, because there are other fields auditd.data.xxx.
If it set as a dynamic template, it keeps all the fields above plus the ones not able to match (auditd.data.a0-N)
There was a problem hiding this comment.
If flattened is expected maybe this should be defined without the wildcard:
- name: auditd.data
description: Auditd related data
type: flattened
There was a problem hiding this comment.
If that definition is changed as:
- name: auditd.data
description: Auditd related data
type: flattenedThis mapping is not created. I think this is caused because there are other definitions present for auditd.data.<field> fields. For instance auditd.data.action (as keyword).
If it is required to be flattened, I'm afraid it should be needed to remove all the auditd.data.<field> definitions.
There was a problem hiding this comment.
This mapping is not created. I think this is caused because there are other definitions present for auditd.data. fields. For instance auditd.data.action (as keyword).
On what version of the stack? This looks like a case of elastic/kibana#204104
| # this mapping does not generate a dynamic template, and the expected fields do not match | ||
| # should it be kept for documentation purposes? | ||
| # - name: auditd.data.a0-N | ||
| # description: the arguments to a syscall | ||
| # type: keyword |
There was a problem hiding this comment.
What should it be done for this field definition ? Just remove it?
There was a problem hiding this comment.
Would it work with a auditd.data.a* definition, specially to keep the documentation?
| # this mapping does not generate a dynamic template, and the expected fields do not match | |
| # should it be kept for documentation purposes? | |
| # - name: auditd.data.a0-N | |
| # description: the arguments to a syscall | |
| # type: keyword | |
| - name: auditd.data.a* | |
| description: the arguments to a syscall | |
| type: keyword |
Though this would match also things that are not arguments.
So maybe this can be removed, yes.
| "a3": "0", | ||
| "arch": "x86_64", | ||
| "audit_pid": "22501", | ||
| "audit_pid": 2532842, |
There was a problem hiding this comment.
It was required to re-generate the sample_event since this field is now a long (as in the field definition).
andrewkroh
added
bugfix
🚀 Benchmarks reportTo see the full report comment with |
andrewkroh
added
Integration:1password
mrodm
force-pushed
the
update_auditd_manager_mappings
branch
from
e32c560 to
f54601d
Compare
mrodm
added
Integration:auditd_manager
mrodm
force-pushed
the
update_auditd_manager_mappings
branch
2 times, most recently
from
1e8b1b3 to
af08a22
Compare
…41bb116f37d13f2d4e04502d0
(cherry picked from commit fa96beb)
mrodm
force-pushed
the
update_auditd_manager_mappings
branch
from
6b08b22 to
d2ba547
Compare
This reverts commit d2ba547.
💚 Build Succeeded
History
cc @mrodm |
|
Proposed commit message
Update field definitions to be valid when
elastic-packageuses validation based on mappings.Errors can be found in this PR: https://buildkite.com/elastic/integrations/builds/21222
To solve these issues this PR :
flattenedtype by a dynamic template where all string fields are converted to keywordauditd.data.a0-Nsince this is not taken into account.Checklist
changelog.ymlfile.Author's Checklist
elastic-packageenabled mappings: https://buildkite.com/elastic/integrations/builds/21793.buildkitefolderHow to test this PR locally
Run elastic-package with mappings validation enabled and run system tests:
Related issues