corelight / corelight/ecs-mapping
Type Error: dns.id and dns.answers.ttl
Open
- Dominant language
- No language data
- Stars
- 33
- Forks
- 14
- PR merge metrics
- No merged PRs in 30d
Description
The current DNS pipeline doesnt convert `dns.answers.ttl` which is copied from the Corelight field `TTLs` to the correct type. It seems Corelight sends it as an `array` however the expected Elastic mapping is a `long`. https://www.elastic.co/guide/en/ecs/current/ecs-dns.html#field-dns-answers-ttl
`dns.id` is indexed as a `keyword` and therefore should be converted to a `string`.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.