Type : IP is not supported as dimension field

[agithomas]

Elasticsearch Version

8.7.0-SNAPSHOT

Installed Plugins

No response

Java Version

bundled

OS Version

Ubuntu 18.08

Problem Description

The problem was identified when i tried to include host.ip of type ip as dimension field. Inspite of annotating the field as dimension field, in the index template the field didn't receive

time_series_dimension": true . It mapping appears as below in index mapping.

"host": {
  "properties": {
    "ip": {
      "type": "ip"
    }
  }
},

To verify this, i created two additional fields, having field mappings (in fields.yml) as below

- name: influxdb.status
  type: group
  release: beta
  fields:
    - name: ip_field_iptype
      type: ip
      dimension: true
    - name: ip_field_keyword_type
      type: keyword
      dimension: true

On verification of component index template , below is my observation

Dimension field mapping appears correctly when the type is keyword. Please see below

"influxdb": {
  "properties": {
    "status": {
      "properties": {
        "ip_field_keyword_type": {
          **"time_series_dimension": true,**
          "type": "keyword"
        },

Dimension field mapping does not appears correctly when the type is ip. Please see below

  "ip_field_iptype": {
    "type": "ip"
  },

Steps to Reproduce

1. Update a package with field mapping as below

    - name: ip_field_iptype
      type: ip
      dimension: true
    - name: ip_field_keyword_type
      type: keyword
      dimension: true

2. Check for the time_series_dimension": true in field mapping

Logs (if relevant)

No response

[elasticsearchmachine]

Pinging @elastic/es-analytics-geo (Team:Analytics)

[martijnvg]

Is this an Elasticsearch issue? I'm asking, because in order to mark fields as dimensions these fields need to use the time_series_dimension attribute in the mapping. This can be defined in the template. If the time_series_dimension attribute isn't set then a field isn't a dimension. Elasticsearch doesn't automatically specify the time_series_dimension attribute, this has to be configured by another actor.

[agithomas]

In the field mapping if 'dimension: true' is annotated for a field, the field becomes a dimension. This has been the case for keyword type field. In such cases, in the index template these fields get 'time_series_dimension' attribute as you mention.

For a field having metric type 'ip', when 'dimension: true' annotation is done, in the index template for these fields 'time_series_dimension' attribute is not observed.

If ES supports dimension for fields of type ip, then the problem lies somewhere else .

[martijnvg]

If ES supports dimension for fields of type ip, then the problem lies somewhere else .

ES does support defining fields of type ip as dimensions. I suspect the problem lies elsewhere?

[lalit-satapathy]

@agithomas, Please check if there is any issue in the mapping done by Fleet. This issue as reference.

[wchaparro]

@lalit-satapathy @agithomas we're planning to close this one as working as designed, but wanted to check with you to ensure that there isn't anything we are missing here.

[agithomas]

@wchaparro , i just did the testing of this feature and i could see time_series_dimension field mapping on type ip. So, it is good to close the issue.

         "ip": {
            "type": "ip",
            "time_series_dimension": true
          },