From 1100b95bf5d96830f15568dbba7d930412669e36 Mon Sep 17 00:00:00 2001 From: ruflin Date: Thu, 12 Nov 2020 10:29:16 +0100 Subject: [PATCH 01/19] Proposal: Default templates: Path match for ip and message One of the problems we have today with the default templates is that ip addresses and message fields are not mapped correct. Auto detection of ip addresses would be great: https://github.com/elastic/elasticsearch/issues/64400 But in the meantime, we could also match on the naming convention that all `*.ip` fields are of type ip address. During implementation I was not sure if I should use `match: ip` for `path_match: *.ip`. The main difference I would expect that the top level is not matched. Are there others? Do we have fields which are named `ip` or `message` which do not adhere to these rules? This PR is not complete but is to share the idea. If we decide to move forward, also the other base templates need updating and it might be useful to add the same logic to all datasets created by Kibana. --- .../core/src/main/resources/logs-mappings.json | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index 04ac179a04b5a..b255f19d4e55f 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -9,6 +9,20 @@ "type": "keyword" }, "match_mapping_type": "string" + }, + "match_ip": { + "match_mapping_type": "string", + "path_match": "*.ip", + "mapping": { + "type": "ip" + } + }, + "match_message": { + "match_mapping_type": "string", + "path_match": "*.message", + "mapping": { + "type": "text" + } } } ], From dae84d6f1e0345e129f42d5ac92b70762467755e Mon Sep 17 00:00:00 2001 From: Nicolas Ruflin Date: Thu, 12 Nov 2020 12:55:36 +0100 Subject: [PATCH 02/19] Update x-pack/plugin/core/src/main/resources/logs-mappings.json Co-authored-by: Adrien Grand --- x-pack/plugin/core/src/main/resources/logs-mappings.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index b255f19d4e55f..fb48934934571 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -21,7 +21,8 @@ "match_mapping_type": "string", "path_match": "*.message", "mapping": { - "type": "text" + "type": "text", + "norms": false } } } From 90ca4b1adfabc2a6578cb79e3093ce5594b6d9ee Mon Sep 17 00:00:00 2001 From: ruflin Date: Fri, 20 Nov 2020 12:52:52 +0100 Subject: [PATCH 03/19] update mapping with discussion --- x-pack/plugin/core/src/main/resources/logs-mappings.json | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index fb48934934571..051e9579fce6a 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -12,14 +12,14 @@ }, "match_ip": { "match_mapping_type": "string", - "path_match": "*.ip", + "match": "ip", "mapping": { "type": "ip" } }, "match_message": { "match_mapping_type": "string", - "path_match": "*.message", + "match": "message", "mapping": { "type": "text", "norms": false @@ -60,9 +60,6 @@ "type": "ip" } } - }, - "message": { - "type": "text" } } } From 35d072765e9e9f0c3b07074d4de9d2597b4d31d3 Mon Sep 17 00:00:00 2001 From: Nicolas Ruflin Date: Thu, 26 Nov 2020 08:20:30 +0100 Subject: [PATCH 04/19] Update x-pack/plugin/core/src/main/resources/logs-mappings.json Co-authored-by: Adrien Grand --- x-pack/plugin/core/src/main/resources/logs-mappings.json | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index 051e9579fce6a..1fb29443e0d67 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -9,7 +9,9 @@ "type": "keyword" }, "match_mapping_type": "string" - }, + } + }, + { "match_ip": { "match_mapping_type": "string", "match": "ip", From ce72eefb9f4c4b170cb421a61d38e64149a69785 Mon Sep 17 00:00:00 2001 From: Nicolas Ruflin Date: Thu, 26 Nov 2020 08:20:36 +0100 Subject: [PATCH 05/19] Update x-pack/plugin/core/src/main/resources/logs-mappings.json Co-authored-by: Adrien Grand --- x-pack/plugin/core/src/main/resources/logs-mappings.json | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index 1fb29443e0d67..c1f37cf301e49 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -18,7 +18,9 @@ "mapping": { "type": "ip" } - }, + } + }, + { "match_message": { "match_mapping_type": "string", "match": "message", From 2e130a55db31051731ebf643567edd551e6a76ed Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Thu, 26 Nov 2020 11:22:05 +0100 Subject: [PATCH 06/19] Put the most specific dynamic templates first. --- .../src/main/resources/logs-mappings.json | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index c1f37cf301e49..5acf5c601c205 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -2,19 +2,10 @@ "template": { "mappings": { "dynamic_templates": [ - { - "strings_as_keyword": { - "mapping": { - "ignore_above": 1024, - "type": "keyword" - }, - "match_mapping_type": "string" - } - }, { "match_ip": { "match_mapping_type": "string", - "match": "ip", + "match": "ip", "mapping": { "type": "ip" } @@ -23,12 +14,21 @@ { "match_message": { "match_mapping_type": "string", - "match": "message", + "match": "message", "mapping": { "type": "text", "norms": false } } + }, + { + "strings_as_keyword": { + "mapping": { + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } } ], "date_detection": false, From 7497f294634d6440523addeded796edfd4a9ad09 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Thu, 26 Nov 2020 11:29:47 +0100 Subject: [PATCH 07/19] Add tests for dynamic templates. --- .../resources/rest-api-spec/test/stack/10_basic.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml index 3b8e41dd07e1f..a39fc295f4c8b 100644 --- a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml +++ b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml @@ -46,6 +46,8 @@ setup: body: "@timestamp": "2020-01-01" message: "test-log-message" + source.ip: "10.1.2.3" + log.file.path: "/var/log/web/access.log" - do: indices.get_data_stream: @@ -64,7 +66,9 @@ setup: - is_true: \.ds-logs-foo-bar-000001.settings - is_true: \.ds-logs-foo-bar-000001.mappings - match: { \.ds-logs-foo-bar-000001.settings.index.lifecycle.name: "logs" } - - is_true: \.ds-logs-foo-bar-000001.mappings.properties.message + - match: { \.ds-logs-foo-bar-000001.mappings.properties.message.type: "text" } + - match: { \.ds-logs-foo-bar-000001.mappings.properties.source.properties.ip.type: "ip" } + - match: { \.ds-logs-foo-bar-000001.mappings.properties.log.properties.file.properties.path.type: "keyword" } - match: { \.ds-logs-foo-bar-000001.data_stream: "logs-foo-bar" } - do: From ce711a7cbe7e213d81b14e6299244169cf7cc5ff Mon Sep 17 00:00:00 2001 From: ruflin Date: Tue, 22 Dec 2020 10:45:42 +0100 Subject: [PATCH 08/19] add mappings to metrics and synthetics too --- .../src/main/resources/metrics-mappings.json | 19 +++++++++ .../main/resources/synthetics-mappings.json | 19 +++++++++ .../rest-api-spec/test/stack/10_basic.yml | 39 +++++++++++++++++++ 3 files changed, 77 insertions(+) diff --git a/x-pack/plugin/core/src/main/resources/metrics-mappings.json b/x-pack/plugin/core/src/main/resources/metrics-mappings.json index d37cdc3f4c53b..ad77b9cacd542 100644 --- a/x-pack/plugin/core/src/main/resources/metrics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/metrics-mappings.json @@ -2,6 +2,25 @@ "template": { "mappings": { "dynamic_templates": [ + { + "match_ip": { + "match_mapping_type": "string", + "match": "ip", + "mapping": { + "type": "ip" + } + } + }, + { + "match_message": { + "match_mapping_type": "string", + "match": "message", + "mapping": { + "type": "text", + "norms": false + } + } + }, { "strings_as_keyword": { "mapping": { diff --git a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json index ca159c4968bef..3c172d733d05b 100644 --- a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json @@ -2,6 +2,25 @@ "template": { "mappings": { "dynamic_templates": [ + { + "match_ip": { + "match_mapping_type": "string", + "match": "ip", + "mapping": { + "type": "ip" + } + } + }, + { + "match_message": { + "match_mapping_type": "string", + "match": "message", + "mapping": { + "type": "text", + "norms": false + } + } + }, { "strings_as_keyword": { "mapping": { diff --git a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml index a39fc295f4c8b..6d220c9247603 100644 --- a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml +++ b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml @@ -83,6 +83,7 @@ setup: body: "@timestamp": "2020-01-01" message: "test-log-message" + source.ip: "10.1.2.3" - do: indices.get_data_stream: @@ -101,9 +102,47 @@ setup: - is_true: \.ds-metrics-foo-bar-000001.settings - is_true: \.ds-metrics-foo-bar-000001.mappings - match: { \.ds-metrics-foo-bar-000001.settings.index.lifecycle.name: "metrics" } + - match: { \.ds-metrics-foo-bar-000001.mappings.properties.message.type: "text" } + - match: { \.ds-metrics-foo-bar-000001.mappings.properties.source.properties.ip.type: "ip" } - is_true: \.ds-metrics-foo-bar-000001.mappings.properties.message - match: { \.ds-metrics-foo-bar-000001.data_stream: "metrics-foo-bar" } - do: indices.delete_data_stream: name: metrics-foo-bar + +--- +"Test synthetics index auto creation": + - do: + index: + index: synthetics-foo-bar + body: + "@timestamp": "2020-01-01" + message: "test-log-message" + source.ip: "10.1.2.3" + + - do: + indices.get_data_stream: + name: synthetics-foo-bar + + - match: { data_streams.0.name: synthetics-foo-bar } + - match: { data_streams.0.timestamp_field.name: '@timestamp' } + - match: { data_streams.0.generation: 1 } + - length: { data_streams.0.indices: 1 } + - match: { data_streams.0.indices.0.index_name: '.ds-synthetics-foo-bar-000001' } + + - do: + indices.get: + index: .ds-synthetics-foo-bar-000001 + + - is_true: \.ds-synthetics-foo-bar-000001.settings + - is_true: \.ds-synthetics-foo-bar-000001.mappings + - match: { \.ds-synthetics-foo-bar-000001.settings.index.lifecycle.name: "synthetics" } + - match: { \.ds-synthetics-foo-bar-000001.mappings.properties.message.type: "text" } + - match: { \.ds-synthetics-foo-bar-000001.mappings.properties.source.properties.ip.type: "ip" } + - is_true: \.ds-synthetics-foo-bar-000001.mappings.properties.message + - match: { \.ds-synthetics-foo-bar-000001.data_stream: "synthetics-foo-bar" } + + - do: + indices.delete_data_stream: + name: synthetics-foo-bar From 74cb397c912909af326fed9934e2742c1612ee34 Mon Sep 17 00:00:00 2001 From: ruflin Date: Tue, 22 Dec 2020 10:49:20 +0100 Subject: [PATCH 09/19] add index renaming --- .../rest-api-spec/test/stack/10_basic.yml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml index 934b98f435a3a..e9724d7f5d222 100644 --- a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml +++ b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml @@ -139,15 +139,15 @@ setup: - do: indices.get: - index: .ds-synthetics-foo-bar-000001 - - - is_true: \.ds-synthetics-foo-bar-000001.settings - - is_true: \.ds-synthetics-foo-bar-000001.mappings - - match: { \.ds-synthetics-foo-bar-000001.settings.index.lifecycle.name: "synthetics" } - - match: { \.ds-synthetics-foo-bar-000001.mappings.properties.message.type: "text" } - - match: { \.ds-synthetics-foo-bar-000001.mappings.properties.source.properties.ip.type: "ip" } - - is_true: \.ds-synthetics-foo-bar-000001.mappings.properties.message - - match: { \.ds-synthetics-foo-bar-000001.data_stream: "synthetics-foo-bar" } + index: $idx0name + + - is_true: $idx0name.settings + - is_true: $idx0name.mappings + - match: { $idx0name.settings.index.lifecycle.name: "synthetics" } + - match: { $idx0name.mappings.properties.message.type: "text" } + - match: { $idx0name.mappings.properties.source.properties.ip.type: "ip" } + - is_true: $idx0name.mappings.properties.message + - match: { $idx0name.data_stream: "synthetics-foo-bar" } - do: indices.delete_data_stream: From 863bae7820b9b7587f6f4c3565927429a36b0e39 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Wed, 21 Apr 2021 14:40:46 +0200 Subject: [PATCH 10/19] Increment registry version. --- .../elasticsearch/xpack/stack/StackTemplateRegistry.java | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java b/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java index c1bd65f70a20a..39094b930e5b2 100644 --- a/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java +++ b/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java @@ -28,11 +28,9 @@ public class StackTemplateRegistry extends IndexTemplateRegistry { private static final Logger logger = LogManager.getLogger(StackTemplateRegistry.class); - // The stack template registry should remain at version 0. This is because templates and - // policies will be changed by the ingest manager once they exist, and ES should only ever put - // the template in place if it does not exist. If this were incremented we could accidentally - // overwrite a template or policy changed by the ingest manager. - public static final int REGISTRY_VERSION = 0; + // The stack template registry version. This number must be incremented when we make changes + // to built-in templates. + public static final int REGISTRY_VERSION = 1; public static final String TEMPLATE_VERSION_VARIABLE = "xpack.stack.template.version"; public static final Setting STACK_TEMPLATES_ENABLED = Setting.boolSetting( From 5dc16be0b1f4fd2008509553cd67ee46cff0b756 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Wed, 21 Apr 2021 14:48:11 +0200 Subject: [PATCH 11/19] Trim message field from metrics and synthetics templates. --- .../core/src/main/resources/metrics-mappings.json | 10 ---------- .../core/src/main/resources/synthetics-mappings.json | 10 ---------- 2 files changed, 20 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/metrics-mappings.json b/x-pack/plugin/core/src/main/resources/metrics-mappings.json index ad77b9cacd542..7d06e2d776d61 100644 --- a/x-pack/plugin/core/src/main/resources/metrics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/metrics-mappings.json @@ -11,16 +11,6 @@ } } }, - { - "match_message": { - "match_mapping_type": "string", - "match": "message", - "mapping": { - "type": "text", - "norms": false - } - } - }, { "strings_as_keyword": { "mapping": { diff --git a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json index 3c172d733d05b..16bce18cacb7a 100644 --- a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json @@ -11,16 +11,6 @@ } } }, - { - "match_message": { - "match_mapping_type": "string", - "match": "message", - "mapping": { - "type": "text", - "norms": false - } - } - }, { "strings_as_keyword": { "mapping": { From 9ea0a35bdeb8e2a57734640713dc1bd25a155d76 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Wed, 21 Apr 2021 14:50:50 +0200 Subject: [PATCH 12/19] Fix tests. --- .../rest-api-spec/test/stack/10_basic.yml | 23 ++++++++----------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml index 524c00a29bd52..f114e3d0507de 100644 --- a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml +++ b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml @@ -68,10 +68,10 @@ setup: - is_true: .$idx0name.settings - is_true: .$idx0name.mappings - match: { .$idx0name.settings.index.lifecycle.name: "logs" } + - is_true: .$idx0name.mappings.properties.message - match: { .$idx0name.mappings.properties.message.type: "text" } - match: { .$idx0name.mappings.properties.source.properties.ip.type: "ip" } - match: { .$idx0name.mappings.properties.log.properties.file.properties.path.type: "keyword" } - - is_true: .$idx0name.mappings.properties.message - match: { .$idx0name.data_stream: "logs-foo-bar" } - do: @@ -85,7 +85,6 @@ setup: index: metrics-foo-bar body: "@timestamp": "2020-01-01" - message: "test-log-message" source.ip: "10.1.2.3" - do: @@ -107,10 +106,7 @@ setup: - is_true: .$idx0name.settings - is_true: .$idx0name.mappings - match: { .$idx0name.settings.index.lifecycle.name: "metrics" } - - match: { .$idx0name.settings.index.lifecycle.name: "metrics" } - - match: { .$idx0name.mappings.properties.message.type: "text" } - match: { .$idx0name.mappings.properties.source.properties.ip.type: "ip" } - - is_true: .$idx0name.mappings.properties.message - match: { .$idx0name.data_stream: "metrics-foo-bar" } - do: @@ -124,7 +120,6 @@ setup: index: synthetics-foo-bar body: "@timestamp": "2020-01-01" - message: "test-log-message" source.ip: "10.1.2.3" - do: @@ -135,19 +130,19 @@ setup: - match: { data_streams.0.timestamp_field.name: '@timestamp' } - match: { data_streams.0.generation: 1 } - length: { data_streams.0.indices: 1 } - - match: { data_streams.0.indices.0.index_name: '.ds-synthetics-foo-bar-000001' } + - match: { data_streams.0.indices.0.index_name: '/\.ds-synthetics-foo-bar-(\d{4}\.\d{2}\.\d{2}-)?000001/' } + + - set: { data_streams.0.indices.0.index_name: idx0name } - do: indices.get: index: $idx0name - - is_true: $idx0name.settings - - is_true: $idx0name.mappings - - match: { $idx0name.settings.index.lifecycle.name: "synthetics" } - - match: { $idx0name.mappings.properties.message.type: "text" } - - match: { $idx0name.mappings.properties.source.properties.ip.type: "ip" } - - is_true: $idx0name.mappings.properties.message - - match: { $idx0name.data_stream: "synthetics-foo-bar" } + - is_true: .$idx0name.settings + - is_true: .$idx0name.mappings + - match: { .$idx0name.settings.index.lifecycle.name: "synthetics" } + - match: { .$idx0name.mappings.properties.source.properties.ip.type: "ip" } + - match: { .$idx0name.data_stream: "synthetics-foo-bar" } - do: indices.delete_data_stream: From 4707606f09d81557b875fb7ccccaa61aee870f11 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Wed, 21 Apr 2021 15:26:34 +0200 Subject: [PATCH 13/19] Factor conventions that are the same for all types into a single file. --- .../main/resources/data-streams-mappings.json | 73 +++++++++++++++++++ .../src/main/resources/logs-mappings.json | 55 +------------- .../src/main/resources/logs-template.json | 1 + .../src/main/resources/metrics-mappings.json | 57 --------------- .../src/main/resources/metrics-template.json | 1 + .../main/resources/synthetics-mappings.json | 64 ---------------- .../main/resources/synthetics-template.json | 1 + .../rest-api-spec/test/stack/10_basic.yml | 4 + .../xpack/stack/StackTemplateRegistry.java | 11 +++ 9 files changed, 92 insertions(+), 175 deletions(-) create mode 100644 x-pack/plugin/core/src/main/resources/data-streams-mappings.json diff --git a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json new file mode 100644 index 0000000000000..054377d78b78e --- /dev/null +++ b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json @@ -0,0 +1,73 @@ +{ + "template": { + "mappings": { + "dynamic_templates": [ + { + "match_ip": { + "match_mapping_type": "string", + "match": "ip", + "mapping": { + "type": "ip" + } + } + }, + { + "strings_as_keyword": { + "mapping": { + "ignore_above": 1024, + "type": "keyword" + }, + "match_mapping_type": "string" + } + } + ], + "date_detection": false, + "properties": { + "@timestamp": { + "type": "date" + }, + "data_stream": { + "properties": { + "type": { + "type": "constant_keyword", + "value": "synthetics" + }, + "dataset": { + "type": "constant_keyword" + }, + "namespace": { + "type": "constant_keyword" + } + } + }, + "ecs": { + "properties": { + "version": { + "ignore_above": 1024, + "type": "keyword" + } + } + }, + "host": { + "properties": { + "ip": { + "type": "ip" + } + } + }, + "observer": { + "properties": { + "ip": { + "type": "ip" + } + } + } + } + } + }, + "_meta": { + "description": "general mapping conventions for data streams", + "managed": true + }, + "version": ${xpack.stack.template.version} +} diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index 5acf5c601c205..e537ad595beab 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -2,15 +2,6 @@ "template": { "mappings": { "dynamic_templates": [ - { - "match_ip": { - "match_mapping_type": "string", - "match": "ip", - "mapping": { - "type": "ip" - } - } - }, { "match_message": { "match_mapping_type": "string", @@ -20,52 +11,8 @@ "norms": false } } - }, - { - "strings_as_keyword": { - "mapping": { - "ignore_above": 1024, - "type": "keyword" - }, - "match_mapping_type": "string" - } - } - ], - "date_detection": false, - "properties": { - "@timestamp": { - "type": "date" - }, - "data_stream": { - "properties": { - "type": { - "type": "constant_keyword", - "value": "logs" - }, - "dataset": { - "type": "constant_keyword" - }, - "namespace": { - "type": "constant_keyword" - } - } - }, - "ecs": { - "properties": { - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "host": { - "properties": { - "ip": { - "type": "ip" - } - } } - } + ] } }, "_meta": { diff --git a/x-pack/plugin/core/src/main/resources/logs-template.json b/x-pack/plugin/core/src/main/resources/logs-template.json index 9c21a2b6ae504..198e0d04ab5af 100644 --- a/x-pack/plugin/core/src/main/resources/logs-template.json +++ b/x-pack/plugin/core/src/main/resources/logs-template.json @@ -4,6 +4,7 @@ "data_stream": {}, "composed_of": [ "logs-mappings", + "data-streams-mappings", "logs-settings" ], "allow_auto_create": true, diff --git a/x-pack/plugin/core/src/main/resources/metrics-mappings.json b/x-pack/plugin/core/src/main/resources/metrics-mappings.json index 7d06e2d776d61..fecdb087df545 100644 --- a/x-pack/plugin/core/src/main/resources/metrics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/metrics-mappings.json @@ -1,62 +1,5 @@ { "template": { - "mappings": { - "dynamic_templates": [ - { - "match_ip": { - "match_mapping_type": "string", - "match": "ip", - "mapping": { - "type": "ip" - } - } - }, - { - "strings_as_keyword": { - "mapping": { - "ignore_above": 1024, - "type": "keyword" - }, - "match_mapping_type": "string" - } - } - ], - "date_detection": false, - "properties": { - "@timestamp": { - "type": "date" - }, - "data_stream": { - "properties": { - "type": { - "type": "constant_keyword", - "value": "metrics" - }, - "dataset": { - "type": "constant_keyword" - }, - "namespace": { - "type": "constant_keyword" - } - } - }, - "ecs": { - "properties": { - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "host": { - "properties": { - "ip": { - "type": "ip" - } - } - } - } - } }, "_meta": { "description": "default mappings for the metrics index template installed by x-pack", diff --git a/x-pack/plugin/core/src/main/resources/metrics-template.json b/x-pack/plugin/core/src/main/resources/metrics-template.json index 0da4169de79b7..b0c4308722912 100644 --- a/x-pack/plugin/core/src/main/resources/metrics-template.json +++ b/x-pack/plugin/core/src/main/resources/metrics-template.json @@ -4,6 +4,7 @@ "data_stream": {}, "composed_of": [ "metrics-mappings", + "data-streams-mappings", "metrics-settings" ], "allow_auto_create": true, diff --git a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json index 16bce18cacb7a..ea5052fab4fad 100644 --- a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json @@ -1,69 +1,5 @@ { "template": { - "mappings": { - "dynamic_templates": [ - { - "match_ip": { - "match_mapping_type": "string", - "match": "ip", - "mapping": { - "type": "ip" - } - } - }, - { - "strings_as_keyword": { - "mapping": { - "ignore_above": 1024, - "type": "keyword" - }, - "match_mapping_type": "string" - } - } - ], - "date_detection": false, - "properties": { - "@timestamp": { - "type": "date" - }, - "data_stream": { - "properties": { - "type": { - "type": "constant_keyword", - "value": "synthetics" - }, - "dataset": { - "type": "constant_keyword" - }, - "namespace": { - "type": "constant_keyword" - } - } - }, - "ecs": { - "properties": { - "version": { - "ignore_above": 1024, - "type": "keyword" - } - } - }, - "host": { - "properties": { - "ip": { - "type": "ip" - } - } - }, - "observer": { - "properties": { - "ip": { - "type": "ip" - } - } - } - } - } }, "_meta": { "description": "default mappings for the synthetics index template installed by x-pack", diff --git a/x-pack/plugin/core/src/main/resources/synthetics-template.json b/x-pack/plugin/core/src/main/resources/synthetics-template.json index 1036a29cf5a9d..0e292f3d8694f 100644 --- a/x-pack/plugin/core/src/main/resources/synthetics-template.json +++ b/x-pack/plugin/core/src/main/resources/synthetics-template.json @@ -4,6 +4,7 @@ "data_stream": {}, "composed_of": [ "synthetics-mappings", + "data-streams-mappings", "synthetics-settings" ], "allow_auto_create": true, diff --git a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml index f114e3d0507de..630d1903856df 100644 --- a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml +++ b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml @@ -14,6 +14,10 @@ setup: ilm.get_lifecycle: policy: "metrics" + - do: + cluster.get_component_template: + name: data-streams-mappings + - do: cluster.get_component_template: name: logs-mappings diff --git a/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java b/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java index 39094b930e5b2..4170e338c8578 100644 --- a/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java +++ b/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java @@ -43,6 +43,16 @@ public class StackTemplateRegistry extends IndexTemplateRegistry { private final ClusterService clusterService; private volatile boolean stackTemplateEnabled; + // General mappings conventions for any data that ends up in a data stream + public static final String DATA_STREAMS_MAPPINGS_COMPONENT_TEMPLATE_NAME = "data-streams-mappings"; + + public static final IndexTemplateConfig DATA_STREAMS_MAPPINGS_COMPONENT_TEMPLATE = new IndexTemplateConfig( + DATA_STREAMS_MAPPINGS_COMPONENT_TEMPLATE_NAME, + "/data-streams-mappings.json", + REGISTRY_VERSION, + TEMPLATE_VERSION_VARIABLE + ); + ////////////////////////////////////////////////////////// // Logs components (for matching logs-*-* indices) ////////////////////////////////////////////////////////// @@ -177,6 +187,7 @@ protected List getPolicyConfigs() { protected List getComponentTemplateConfigs() { if (stackTemplateEnabled) { return Arrays.asList( + DATA_STREAMS_MAPPINGS_COMPONENT_TEMPLATE, LOGS_MAPPINGS_COMPONENT_TEMPLATE, LOGS_SETTINGS_COMPONENT_TEMPLATE, METRICS_MAPPINGS_COMPONENT_TEMPLATE, From c9249b5d78d29bfb7f6e32ab214833e168fa392f Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Thu, 22 Apr 2021 09:37:50 +0200 Subject: [PATCH 14/19] Fix data_stream type. Also move from `text` to `match_only_text`. --- .../main/resources/data-streams-mappings.json | 4 -- .../src/main/resources/logs-mappings.json | 15 ++++- .../src/main/resources/metrics-mappings.json | 12 ++++ .../main/resources/synthetics-mappings.json | 12 ++++ .../rest-api-spec/test/stack/10_basic.yml | 62 ++++++++++++++++++- 5 files changed, 97 insertions(+), 8 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json index 054377d78b78e..9b22a8d8cc303 100644 --- a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json +++ b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json @@ -28,10 +28,6 @@ }, "data_stream": { "properties": { - "type": { - "type": "constant_keyword", - "value": "synthetics" - }, "dataset": { "type": "constant_keyword" }, diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index e537ad595beab..7481d646ed106 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -7,12 +7,21 @@ "match_mapping_type": "string", "match": "message", "mapping": { - "type": "text", - "norms": false + "type": "match_only_text" } } } - ] + ], + "properties": { + "data_stream": { + "properties": { + "type": { + "type": "constant_keyword", + "value": "logs" + } + } + } + } } }, "_meta": { diff --git a/x-pack/plugin/core/src/main/resources/metrics-mappings.json b/x-pack/plugin/core/src/main/resources/metrics-mappings.json index fecdb087df545..07e6194e3c0e5 100644 --- a/x-pack/plugin/core/src/main/resources/metrics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/metrics-mappings.json @@ -1,5 +1,17 @@ { "template": { + "mappings": { + "properties": { + "data_stream": { + "properties": { + "type": { + "type": "constant_keyword", + "value": "metrics" + } + } + } + } + } }, "_meta": { "description": "default mappings for the metrics index template installed by x-pack", diff --git a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json index ea5052fab4fad..96eb9cc400fde 100644 --- a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json @@ -1,5 +1,17 @@ { "template": { + "mappings": { + "properties": { + "data_stream": { + "properties": { + "type": { + "type": "constant_keyword", + "value": "synthetics" + } + } + } + } + } }, "_meta": { "description": "default mappings for the synthetics index template installed by x-pack", diff --git a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml index 630d1903856df..4138d1577bcf4 100644 --- a/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml +++ b/x-pack/plugin/stack/qa/rest/src/yamlRestTest/resources/rest-api-spec/test/stack/10_basic.yml @@ -52,6 +52,9 @@ setup: message: "test-log-message" source.ip: "10.1.2.3" log.file.path: "/var/log/web/access.log" + data_stream.type: "logs" + data_stream.dataset: "foo" + data_stream.namespace: "bar" - do: indices.get_data_stream: @@ -72,8 +75,14 @@ setup: - is_true: .$idx0name.settings - is_true: .$idx0name.mappings - match: { .$idx0name.settings.index.lifecycle.name: "logs" } + - match: { .$idx0name.mappings.properties.data_stream.properties.type.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.type.value: "logs" } + - match: { .$idx0name.mappings.properties.data_stream.properties.dataset.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.dataset.value: "foo" } + - match: { .$idx0name.mappings.properties.data_stream.properties.namespace.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.namespace.value: "bar" } - is_true: .$idx0name.mappings.properties.message - - match: { .$idx0name.mappings.properties.message.type: "text" } + - match: { .$idx0name.mappings.properties.message.type: "match_only_text" } - match: { .$idx0name.mappings.properties.source.properties.ip.type: "ip" } - match: { .$idx0name.mappings.properties.log.properties.file.properties.path.type: "keyword" } - match: { .$idx0name.data_stream: "logs-foo-bar" } @@ -90,6 +99,9 @@ setup: body: "@timestamp": "2020-01-01" source.ip: "10.1.2.3" + data_stream.type: "metrics" + data_stream.dataset: "foo" + data_stream.namespace: "bar" - do: indices.get_data_stream: @@ -110,6 +122,12 @@ setup: - is_true: .$idx0name.settings - is_true: .$idx0name.mappings - match: { .$idx0name.settings.index.lifecycle.name: "metrics" } + - match: { .$idx0name.mappings.properties.data_stream.properties.type.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.type.value: "metrics" } + - match: { .$idx0name.mappings.properties.data_stream.properties.dataset.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.dataset.value: "foo" } + - match: { .$idx0name.mappings.properties.data_stream.properties.namespace.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.namespace.value: "bar" } - match: { .$idx0name.mappings.properties.source.properties.ip.type: "ip" } - match: { .$idx0name.data_stream: "metrics-foo-bar" } @@ -125,6 +143,9 @@ setup: body: "@timestamp": "2020-01-01" source.ip: "10.1.2.3" + data_stream.type: "synthetics" + data_stream.dataset: "foo" + data_stream.namespace: "bar" - do: indices.get_data_stream: @@ -145,9 +166,48 @@ setup: - is_true: .$idx0name.settings - is_true: .$idx0name.mappings - match: { .$idx0name.settings.index.lifecycle.name: "synthetics" } + - match: { .$idx0name.mappings.properties.data_stream.properties.type.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.type.value: "synthetics" } + - match: { .$idx0name.mappings.properties.data_stream.properties.dataset.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.dataset.value: "foo" } + - match: { .$idx0name.mappings.properties.data_stream.properties.namespace.type: "constant_keyword" } + - match: { .$idx0name.mappings.properties.data_stream.properties.namespace.value: "bar" } - match: { .$idx0name.mappings.properties.source.properties.ip.type: "ip" } - match: { .$idx0name.data_stream: "synthetics-foo-bar" } - do: indices.delete_data_stream: name: synthetics-foo-bar + +--- +"Test wrong data_stream type": + + - do: + catch: bad_request + index: + index: synthetics-dataset0-namespace1 + body: + "@timestamp": "2020-01-01" + data_stream.type: "logs" + data_stream.dataset: "dataset0" + data_stream.namespace: "namespace1" + + - do: + catch: bad_request + index: + index: logs-dataset0-namespace1 + body: + "@timestamp": "2020-01-01" + data_stream.type: "metrics" + data_stream.dataset: "dataset0" + data_stream.namespace: "namespace1" + + - do: + catch: bad_request + index: + index: metrics-dataset0-namespace1 + body: + "@timestamp": "2020-01-01" + data_stream.type: "synthetics" + data_stream.dataset: "dataset0" + data_stream.namespace: "namespace1" From db58ab94f794aa4fa58b17128a951b499c1f8c0a Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Thu, 22 Apr 2021 09:40:44 +0200 Subject: [PATCH 15/19] Simplify host and observer mappings. --- .../src/main/resources/data-streams-mappings.json | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json index 9b22a8d8cc303..99063e3b4cca3 100644 --- a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json +++ b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json @@ -45,18 +45,10 @@ } }, "host": { - "properties": { - "ip": { - "type": "ip" - } - } + "type": "object" }, "observer": { - "properties": { - "ip": { - "type": "ip" - } - } + "type": "object" } } } From 9950d8b53f7794d75efcb02a13754a8771e73911 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Thu, 22 Apr 2021 09:43:30 +0200 Subject: [PATCH 16/19] Fix indentation. --- x-pack/plugin/core/src/main/resources/logs-mappings.json | 4 ++-- x-pack/plugin/core/src/main/resources/metrics-mappings.json | 4 ++-- .../plugin/core/src/main/resources/synthetics-mappings.json | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index 7481d646ed106..5726320beb0c2 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -16,8 +16,8 @@ "data_stream": { "properties": { "type": { - "type": "constant_keyword", - "value": "logs" + "type": "constant_keyword", + "value": "logs" } } } diff --git a/x-pack/plugin/core/src/main/resources/metrics-mappings.json b/x-pack/plugin/core/src/main/resources/metrics-mappings.json index 07e6194e3c0e5..e41863f282dce 100644 --- a/x-pack/plugin/core/src/main/resources/metrics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/metrics-mappings.json @@ -5,8 +5,8 @@ "data_stream": { "properties": { "type": { - "type": "constant_keyword", - "value": "metrics" + "type": "constant_keyword", + "value": "metrics" } } } diff --git a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json index 96eb9cc400fde..9e3e56e3261d0 100644 --- a/x-pack/plugin/core/src/main/resources/synthetics-mappings.json +++ b/x-pack/plugin/core/src/main/resources/synthetics-mappings.json @@ -5,8 +5,8 @@ "data_stream": { "properties": { "type": { - "type": "constant_keyword", - "value": "synthetics" + "type": "constant_keyword", + "value": "synthetics" } } } From c4cb7fd4137d46979a9256ffd3d18bc726cef04f Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Thu, 22 Apr 2021 18:31:55 +0200 Subject: [PATCH 17/19] Fix test failure. --- .../xpack/stack/StackTemplateRegistryTests.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java b/x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java index e069075e5795d..47c25ae239bc3 100644 --- a/x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java +++ b/x-pack/plugin/stack/src/test/java/org/elasticsearch/xpack/stack/StackTemplateRegistryTests.java @@ -277,6 +277,7 @@ public void testSameOrHigherVersionTemplateNotUpgraded() { DiscoveryNodes nodes = DiscoveryNodes.builder().localNodeId("node").masterNodeId("node").add(node).build(); Map versions = new HashMap<>(); + versions.put(StackTemplateRegistry.DATA_STREAMS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION); versions.put(StackTemplateRegistry.LOGS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION); versions.put(StackTemplateRegistry.LOGS_MAPPINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION); versions.put(StackTemplateRegistry.METRICS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION); @@ -302,6 +303,10 @@ public void testSameOrHigherVersionTemplateNotUpgraded() { registry.clusterChanged(sameVersionEvent); versions.clear(); + versions.put( + StackTemplateRegistry.DATA_STREAMS_MAPPINGS_COMPONENT_TEMPLATE_NAME, + StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000) + ); versions.put( StackTemplateRegistry.LOGS_SETTINGS_COMPONENT_TEMPLATE_NAME, StackTemplateRegistry.REGISTRY_VERSION + randomIntBetween(1, 1000) From f7376e504d8eeec4bcee2eb1f26faa5f99ae9852 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Mon, 3 May 2021 11:34:20 +0200 Subject: [PATCH 18/19] Move `message` dynamic template to the shared mapping template. --- .../src/main/resources/data-streams-mappings.json | 9 +++++++++ .../plugin/core/src/main/resources/logs-mappings.json | 11 ----------- 2 files changed, 9 insertions(+), 11 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json index 99063e3b4cca3..8cf149419493b 100644 --- a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json +++ b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json @@ -11,6 +11,15 @@ } } }, + { + "match_message": { + "match_mapping_type": "string", + "match": "message", + "mapping": { + "type": "match_only_text" + } + } + }, { "strings_as_keyword": { "mapping": { diff --git a/x-pack/plugin/core/src/main/resources/logs-mappings.json b/x-pack/plugin/core/src/main/resources/logs-mappings.json index 5726320beb0c2..1851f36947cc8 100644 --- a/x-pack/plugin/core/src/main/resources/logs-mappings.json +++ b/x-pack/plugin/core/src/main/resources/logs-mappings.json @@ -1,17 +1,6 @@ { "template": { "mappings": { - "dynamic_templates": [ - { - "match_message": { - "match_mapping_type": "string", - "match": "message", - "mapping": { - "type": "match_only_text" - } - } - } - ], "properties": { "data_stream": { "properties": { From 42c9f58cfe8bc02bf9d66383597bc54919a53245 Mon Sep 17 00:00:00 2001 From: Adrien Grand Date: Mon, 3 May 2021 11:35:40 +0200 Subject: [PATCH 19/19] Remove `observer` field. --- .../plugin/core/src/main/resources/data-streams-mappings.json | 3 --- 1 file changed, 3 deletions(-) diff --git a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json index 8cf149419493b..f87c0e79b7c45 100644 --- a/x-pack/plugin/core/src/main/resources/data-streams-mappings.json +++ b/x-pack/plugin/core/src/main/resources/data-streams-mappings.json @@ -55,9 +55,6 @@ }, "host": { "type": "object" - }, - "observer": { - "type": "object" } } }