elastic / elastic/integrations

Elasticsearch integration mapping/field inconsitencies

Open
#2,286 7 comments 0 reactions 0 assignees View on GitHub
bug Integration:elasticsearch Team:Stack Monitoring
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

There are some field type inconsistencies between the `System` integration and the `Elasticsearch` integration. This leads Kibana to show the message:
````
Mapping conflict
A field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use these conflict fields in parts of Kibana, but they will be unavailable for functions that require Kibana to know their type. Correcting this issue will require reindexing your data.
````

It is looking similar to https://github.com/elastic/integrations/issues/1573 and I think it makes the `Elasticsearch` integration non-ECS complaint, which I suppose should be considered a bug.

Checking those conflicts manually, we get the following details.
For `metrics-*`:
- `host.ip` maps to a `keyword` ❗ vs. `ip` ✅ in the System package
Screen Shot 2021-11-30 at 12 53 28
Screen Shot 2021-11-30 at 12 53 05

For `logs-*`:
- `event.created` maps to `keyword` ❗ vs. `date` ✅ in the System package
Screen Shot 2021-11-30 at 12 58 55
Screen Shot 2021-11-30 at 12 59 48

- `host.ip` maps to a `keyword` ❗ vs. `ip` ✅ in the System package
Screen Shot 2021-11-30 at 13 01 00
Screen Shot 2021-11-30 at 13 01 27

- `process.pid` maps to a `keyword` ❗ vs. `long` ✅ in the System package
Screen Shot 2021-11-30 at 13 02 16
Screen Shot 2021-11-30 at 13 03 06

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.