elastic / elastic/integrations

ecs@mappings result is not matching the ecs (ref: https://www.elastic.co/docs/reference/ecs)

Open
#19,957 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

I want to point out that the dynamic mapping choose an unexpected type for some field names by using ecs@mappings.
(ref: https://www.elastic.co/docs/reference/ecs)

For example:
process.pid
-expected: long
-result: keyword
source.port
-expected: long
-result: keyword

I know it is easy to declaim the type manually.
But should I expect ecs@mappings to match the ecs in offical document?
(I read the json script from 'ecs@mappings', it is true that the code is matching the result)

my elk version is 9.4.2

Contributor guide

Open the contributing guide

Research direction

Start with the ecs@mappings JSON script mentioned in the report and compare its entries for process.pid and source.port with the ECS reference documentation. Verify whether the generated dynamic mappings produce long for both fields, and consider the issue resolved when the mappings match the documented ECS types.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.