elastic / elastic/package-spec

[Change Proposal] Automation for initial creation of ecs.yml and fields.yml + proposal for adding support for field groups

Open
#206 0 comments 1 reaction 0 assignees View on GitHub
discuss Team:Integrations
Dominant language
Go
Stars
20
Forks
93
Avg merge
15h 10m
Merged PRs (30d)
12

Description

As mentioned by @jsoriano , we might not want to make it too easy to add many unused ECS fields, but if the focus for many of us is going to be new integrations, making this a bi more streamlined might be nice, here is my suggestions:

**1. It would be nice to be able to reference a parent field when filling out the ecs.yml.**
From:
```
- name: event.kind
external: ecs
- name: event.original
external: ecs
- name: event.type
external: ecs
- name: event.category
external: ecs
- name: event.ingested
external: ecs
- name: event.created
external: ecs
- name: event.severity
external: ecs
- name: event.action
external: ecs
- name: event.reason
external: ecs
```
To:
```
- name: event
external: ecs
```
Another option would be to define the top name (in this case event), and just have a list of all the subfields we want to include, that makes the ecs.yml file more structured.
For example:
```
- name: event
fields: kind,original,type
external: ecs
```

**2. Autogenerating to help people get started with field mapping**
When building a package, the process is usually starting with adding some test data, create an ingest pipeline, generate the expected.json output from the test samples and then finish off by creating the ecs.yml and fields.yml for each package.

Since expected.json is often already created, maybe it would be nice to have the pipeline test runner in elastic-package extended to autogenerate fields.yml and ecs.yml based on these files?
It would need to generate all the test files, and in the end it should have a more complete list of unique ECS and non-ECS fields, making the life easier for package developers.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.