quickwit-oss / quickwit-oss/quickwit
Unable to ingest field names with periods for ip type
Open
@trinity-1686a is already working on this.
Since Aug 22, 2024.
bug
- Dominant language
- Rust
- Stars
- 11.7k
- Forks
- 597
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 37
Description
Describe the bug
When attempting to ingest an ip type from a field name with a dot (client.ip), the field fails to ingest properly and the field does not exist when querying the data.
Additionally, there is differing behavior on query time when ingesting flattened vs unflattened json:
- Unflattened: client":{"ip":"1.1.1.1"} returns no results/queries for the IP
- Flattened: "client.ip":"1.1.1.1" still shows no client.ip field in the results but you can search for the ip and it does return the correct doc(s)
Steps to reproduce (if applicable)
- Ingest sample ( {"@timestamp":"2024-08-20T16:54:22.842000000Z","client":{"ip":"1.1.1.1"}})
- Query index and it returns:
{
"@timestamp": "2024-08-20T16:54:22.842000000Z"
}
Expected behavior
I expected the ip to be ingested as an ip type.
Configuration:
Quickwit Version: 0.8.2
Index Config:
version: 0.8
index_id: test3
doc_mapping:
mode: lenient
timestamp_field: '@timestamp'
field_mappings:
- name: '@timestamp'
type: datetime
input_formats:
- iso8601
output_format: iso8601
fast_precision: seconds
fast: true
- name: client.ip
type: ip
fast: true
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.