From ba8b93d590ab4caa2d1f49d5940cb8478c098365 Mon Sep 17 00:00:00 2001
From: Ryland Herrick <ryalnd@gmail.com>
Date: Fri, 14 Jan 2022 12:47:50 -0600
Subject: [PATCH] Account for scaling_factor property from ECS

This is a required field for e.g. scaled_float fields, so we need to
reflect its value in our field map.
---
 .../common/assets/field_maps/ecs_field_map.ts             | 1 +
 x-pack/plugins/rule_registry/common/field_map/types.ts    | 1 +
 .../rule_registry/scripts/generate_ecs_fieldmap/index.js  | 8 +++++++-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts b/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
index 2da6ec1f9ecf50..7c4095cca039fd 100644
--- a/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
+++ b/x-pack/plugins/rule_registry/common/assets/field_maps/ecs_field_map.ts
@@ -1499,6 +1499,7 @@ export const ecsFieldMap = {
     type: 'scaled_float',
     array: false,
     required: false,
+    scaling_factor: 1000,
   },
   'host.disk.read.bytes': {
     type: 'long',
diff --git a/x-pack/plugins/rule_registry/common/field_map/types.ts b/x-pack/plugins/rule_registry/common/field_map/types.ts
index ad2f8ed1e5536d..6eeffa12400fe2 100644
--- a/x-pack/plugins/rule_registry/common/field_map/types.ts
+++ b/x-pack/plugins/rule_registry/common/field_map/types.ts
@@ -11,5 +11,6 @@ export interface FieldMap {
     required?: boolean;
     array?: boolean;
     path?: string;
+    scaling_factor?: number;
   };
 }
diff --git a/x-pack/plugins/rule_registry/scripts/generate_ecs_fieldmap/index.js b/x-pack/plugins/rule_registry/scripts/generate_ecs_fieldmap/index.js
index bbcf651bd6d691..5e90a3c16aa7c6 100644
--- a/x-pack/plugins/rule_registry/scripts/generate_ecs_fieldmap/index.js
+++ b/x-pack/plugins/rule_registry/scripts/generate_ecs_fieldmap/index.js
@@ -33,11 +33,17 @@ async function generate() {
   const flatYaml = await yaml.safeLoad(await readFile(ecsYamlFilename));
 
   const fields = mapValues(flatYaml, (description) => {
-    return {
+    const field = {
       type: description.type,
       array: description.normalize.includes('array'),
       required: !!description.required,
     };
+
+    if (description.scaling_factor) {
+      field.scaling_factor = description.scaling_factor;
+    }
+
+    return field;
   });
 
   await Promise.all([