Skip to content

zeek: use dynamic mapping for object fields - #8080

Merged
efd6 merged 1 commit into
elastic:mainfrom
efd6:8063-zeek
Oct 4, 2023
Merged

zeek: use dynamic mapping for object fields#8080
efd6 merged 1 commit into
elastic:mainfrom
efd6:8063-zeek

Conversation

@efd6

@efd6 efd6 commented Oct 4, 2023

Copy link
Copy Markdown
Contributor

Proposed commit message

See title.

      "dynamic_templates": [
        {
          "zeek.intel.seen.f.*": {
            "path_match": "zeek.intel.seen.f.*",
            "mapping": {
              "type": "keyword"
            }
          }
        },
        {
          "strings_as_keyword": {
            "match_mapping_type": "string",
            "mapping": {
              "ignore_above": 1024,
              "type": "keyword"
            }
          }
        }
      ],

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Screenshots

@efd6 efd6 self-assigned this Oct 4, 2023
@elasticmachine

elasticmachine commented Oct 4, 2023 •
edited
Loading

Copy link
Copy Markdown

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-10-04T05:27:57.709+0000

  • Duration: 57 min 21 sec

Test stats 🧪

Test Results
Failed 0
Passed 254
Skipped 0
Total 254

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

@elasticmachine

elasticmachine commented Oct 4, 2023

Copy link
Copy Markdown

🌐 Coverage report

Name Metrics % (covered/total) Diff
Packages 100.0% (43/43) 💚
Files 96.341% (79/82) 👎 -3.659
Classes 96.341% (79/82) 👎 -3.659
Methods 92.021% (692/752) 👎 -0.712
Lines 92.055% (8632/9377) 👍 0.412
Conditionals 100.0% (0/0) 💚

@efd6
efd6 marked this pull request as ready for review October 4, 2023 06:44
@efd6
efd6 requested a review from a team as a code owner October 4, 2023 06:44
@elasticmachine

elasticmachine commented Oct 4, 2023

Copy link
Copy Markdown

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

andrewkroh
andrewkroh approved these changes Oct 4, 2023
View reviewed changes

@andrewkroh andrewkroh left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I should say that I have never seen this field get populated, and could not find any real examples. But going off the docs, I think it may be possible to have fields beyond the first level of ".*"

If we ever see some real examples that have fields like zeek.intel.seen.f.ftp.cwd then we can expand this definition or switch to flattened.

@efd6
efd6 merged commit cc5374c into elastic:main Oct 4, 2023
@elasticmachine

elasticmachine commented Oct 4, 2023

Copy link
Copy Markdown

Package zeek - 2.19.0 containing this change is available at https://epr.elastic.co/search?package=zeek

@efd6
efd6 deleted the 8063-zeek branch February 5, 2025 22:04
orestisfl pushed a commit to orestisfl/integrations that referenced this pull request May 15, 2026
@efd6
zeek: use dynamic mapping for object fields (elastic#8080)
29b9030
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrewkroh andrewkroh andrewkroh approved these changes

Assignees

@efd6 efd6

Labels

enhancement New feature or request Integration:zeek Zeek

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[zeek.intel] Use more specific mapping for zeek.intel.seen.f

3 participants

@efd6 @elasticmachine @andrewkroh