Skip to content

Commit

Permalink
[RAC][Rule Registry] Generate ECS fieldmap from ECS 8.0 (#123012) (#1…
Browse files Browse the repository at this point in the history
…23334)

* Generate ECS fieldmap from ECS 8.0

This is the result of running the generate_ecs_fieldmap script against
ECS' 8.0 branch.

* Account for scaling_factor property from ECS

This is a required field for e.g. scaled_float fields, so we need to
reflect its value in our field map.

* Remove unused, unset property from FieldMap

It does not appear that this value was ever being set, nor does this
value appear in ECS' flat output, so I'm removing it for now to keep our
types as accurate as possible.

* Add path back to FieldMap definition

This is a required field for type: alias fields.

* Try upping the fields limit on our ECS component template

This now exceeds the default of 1000.

* Bump our field limit a bit more

Apparently 1300 wasn't enough, either.

* Fix type error

Makes this field optional, since the technical component template
doesn't currently use it.

* Bump the field limit of our composed template

Including the newest ECS fields, this index now exceeds 1600 fields.
This value should probably be derived from the composed template's
limits, but for now this allows the template to be created.

Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 8737691)

Co-authored-by: Ryland Herrick <ryalnd@gmail.com>
  • Loading branch information
kibanamachine and rylnd authored Jan 19, 2022
1 parent 73f4aba commit dcfcec9
Show file tree
Hide file tree
Showing 6 changed files with 2,747 additions and 487 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ export const ecsComponentTemplate: ClusterPutComponentTemplateBody = {
template: {
settings: {
number_of_shards: 1,
'index.mapping.total_fields.limit': 1500,
},
mappings: merge(
{},
Expand Down
Loading

0 comments on commit dcfcec9

Please sign in to comment.