elastic / elastic/integrations

[ Azure Logs ] Wrong mapping in the Activity Logs data set result in ignored fields and poor data set quality

Open
#13,692 4 comments 1 reaction 1 assignee Claimed by @muthu-mps View on GitHub
Integration:azure mapping/pipeline issue Stalled Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

Hello,

I was just checking the Data Set Quality feature in Kibana and saw that the worst offender and only data set with Poor quality was a native integration, more specifically the Azure Activity Logs.

Checking the reason for this I saw that almost all events have an `_ignored` field because of a wrong mapping.

The field `azure.activitylogs.level` is wrongly mapped as `long`, but the values in the documents are strings like _Informational_ or _Error_.

This field should be remapped as `keyword`.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.