corelight / corelight/ecs-dashboards
When importing new version fields do not map correctly
Open
- Dominant language
- No language data
- Stars
- 9
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
I have noticed that when I have switched from v24 to v25 and uploaded the new ndjson file several of the visualizations no longer work.
This requires me to go in and update the field in each and change from what it was to same name with just .keyword at the end.
Example is the _event.dataset: notice AND network.transport: icmp_ visualization is looking for notice.message and that is not found. Switching that to notice.message.keyword the visualization then starts working.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.