elastic / elastic/integrations
[ Cloudflare Audit ] Flattened fields should to be duplicate as match_only_text to be used in Security Rules
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
Hello,
The Cloudflare Audit dataset from the Cloudflare Logpush integration has 3 main fields:
- `cloudflare_logpush.audit.metadata`
- `cloudflare_logpush.audit.new_value`
- `cloudflare_logpush.audit.old_value`
All 3 are mapped as `flattened` which is expected since they can be very dynamic, but with them being `flattened` fields we cannot use them on Security ESQL rules as ESQL does not support `flattened` fields yet.
The alternative in this case would be to have a similar approach to what is done in other integrations, like the AWS Cloudtrail integration, where the field is duplicated with a different mapping.
In this case they could be duplicated as `match_only_text` to allow them to be used in ESQL rules.
For example, we could have something like this:
- `cloudflare_logpush.audit.text.metadata`
- `cloudflare_logpush.audit.text.new_value`
- `cloudflare_logpush.audit.text.old_value`
Contributor guide
Assessment
This issue has not been assessed yet.