From 88eae3ef401d529d61631d32cd4f1fdfc761dd6d Mon Sep 17 00:00:00 2001
From: Nicolas Chaulet <nicolas.chaulet@elastic.co>
Date: Wed, 3 Aug 2022 14:04:07 -0400
Subject: [PATCH] [Fleet] Generate dynamic template mappings for field with
 wildcard in name (#137978)

---
 .../server/services/epm/fields/field.test.ts  | 46 +++++++++++++++++++
 .../fleet/server/services/epm/fields/field.ts | 17 ++++++-
 2 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/fleet/server/services/epm/fields/field.test.ts b/x-pack/plugins/fleet/server/services/epm/fields/field.test.ts
index 8be5f4655b480e..ad1787c97aa199 100644
--- a/x-pack/plugins/fleet/server/services/epm/fields/field.test.ts
+++ b/x-pack/plugins/fleet/server/services/epm/fields/field.test.ts
@@ -624,4 +624,50 @@ describe('processFields', () => {
     ];
     expect(processFields(fields)).toEqual(fieldsExpected);
   });
+
+  test('handle wildcard field', () => {
+    const wildcardFields = [
+      {
+        name: 'a.*.b',
+        type: 'keyword',
+      },
+      {
+        name: 'a.b.*',
+        type: 'scaled_float',
+      },
+    ];
+
+    expect(processFields(wildcardFields)).toMatchInlineSnapshot(`
+      [
+        {
+          "name": "a",
+          "type": "group",
+          "fields": [
+            {
+              "name": "*",
+              "type": "group",
+              "fields": [
+                {
+                  "name": "b",
+                  "type": "object",
+                  "object_type": "keyword"
+                }
+              ]
+            },
+            {
+              "name": "b",
+              "type": "group",
+              "fields": [
+                {
+                  "name": "*",
+                  "type": "object",
+                  "object_type": "scaled_float"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    `);
+  });
 });
diff --git a/x-pack/plugins/fleet/server/services/epm/fields/field.ts b/x-pack/plugins/fleet/server/services/epm/fields/field.ts
index 8d784e0cffc228..1759946f4f5242 100644
--- a/x-pack/plugins/fleet/server/services/epm/fields/field.ts
+++ b/x-pack/plugins/fleet/server/services/epm/fields/field.ts
@@ -246,8 +246,23 @@ export const getField = (fields: Fields, pathNames: string[]): Field | undefined
   return undefined;
 };
 
+export function processFieldsWithWildcard(fields: Fields): Fields {
+  const newFields: Fields = [];
+  for (const field of fields) {
+    const hasWildcard = field.name.includes('*');
+    const hasObjectType = field.object_type;
+    if (hasWildcard && !hasObjectType) {
+      newFields.push({ ...field, type: 'object', object_type: field.type });
+    } else {
+      newFields.push({ ...field });
+    }
+  }
+  return newFields;
+}
+
 export function processFields(fields: Fields): Fields {
-  const expandedFields = expandFields(fields);
+  const processedFields = processFieldsWithWildcard(fields);
+  const expandedFields = expandFields(processedFields);
   const dedupedFields = dedupFields(expandedFields);
   return validateFields(dedupedFields, dedupedFields);
 }