elastic / elastic/integrations
ecs@mappings result is not matching the ecs (ref: https://www.elastic.co/docs/reference/ecs)
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
I want to point out that the dynamic mapping choose an unexpected type for some field names by using ecs@mappings.
(ref: https://www.elastic.co/docs/reference/ecs)
For example:
process.pid
-expected: long
-result: keyword
source.port
-expected: long
-result: keyword
I know it is easy to declaim the type manually.
But should I expect ecs@mappings to match the ecs in offical document?
(I read the json script from 'ecs@mappings', it is true that the code is matching the result)
my elk version is 9.4.2
Contributor guide
Research direction
Start with the ecs@mappings JSON script mentioned in the report and compare its entries for process.pid and source.port with the ECS reference documentation. Verify whether the generated dynamic mappings produce long for both fields, and consider the issue resolved when the mappings match the documented ECS types.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100