elastic / elastic/integrations

[8.18 testing] Validate synthetic_source_keep: "none" is added to mappings for ECS tags

Open
#12,485 3 comments 0 reactions 0 assignees View on GitHub
Stalled Team:Security-Deployment and Devices
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

We need to verify that the mapping attribute for `synthetic_source_keep` carries through from imported ECS mappings. [`synthetic_source_keep`](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-source-field.html#synthetic-source-keep) can be specified as an attribute in the ECS schema as of 8.18.

- Update an integration that contains mappings for `tags` to import the v8.18.0 version of elastic/ecs
- Install it to kibana
- View the associated component template for the integration
- Verify that it contains `synthetic_source_keep: none` for the `tags` field

If not present, then we need to open issues to ensure the attribute is plumbed through Fleet to the Elasticsearch mappings.

Related issues

- https://github.com/elastic/ecs/issues/2376

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.