elastic / elastic/integrations
[ Azure Logs ] Wrong mapping in the Activity Logs data set result in ignored fields and poor data set quality
Open
Integration:azure
mapping/pipeline issue
Stalled
Team:Obs-InfraObs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
Hello,
I was just checking the Data Set Quality feature in Kibana and saw that the worst offender and only data set with Poor quality was a native integration, more specifically the Azure Activity Logs.
Checking the reason for this I saw that almost all events have an `_ignored` field because of a wrong mapping.
The field `azure.activitylogs.level` is wrongly mapped as `long`, but the values in the documents are strings like _Informational_ or _Error_.
This field should be remapped as `keyword`.
Contributor guide
Assessment
This issue has not been assessed yet.