corelight / corelight/ecs-dashboards

When importing new version fields do not map correctly

Open
#4 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
9
Forks
4
PR merge metrics
No merged PRs in 30d

Description

I have noticed that when I have switched from v24 to v25 and uploaded the new ndjson file several of the visualizations no longer work.

This requires me to go in and update the field in each and change from what it was to same name with just .keyword at the end.

Example is the _event.dataset: notice AND network.transport: icmp_ visualization is looking for notice.message and that is not found. Switching that to notice.message.keyword the visualization then starts working.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.