quickwit-oss / quickwit-oss/quickwit

Unable to ingest field names with periods for ip type

Open
#5,333 0 comments 0 reactions 1 assignee View on GitHub

@trinity-1686a is already working on this.

Since Aug 22, 2024.

bug
Dominant language
Rust
Stars
11.7k
Forks
597
Avg merge
2d 22h
Merged PRs (30d)
37

Description

Describe the bug
When attempting to ingest an ip type from a field name with a dot (client.ip), the field fails to ingest properly and the field does not exist when querying the data.

Additionally, there is differing behavior on query time when ingesting flattened vs unflattened json:

  • Unflattened: client":{"ip":"1.1.1.1"} returns no results/queries for the IP
  • Flattened: "client.ip":"1.1.1.1" still shows no client.ip field in the results but you can search for the ip and it does return the correct doc(s)

Steps to reproduce (if applicable)

  1. Ingest sample ( {"@timestamp":"2024-08-20T16:54:22.842000000Z","client":{"ip":"1.1.1.1"}})
  2. Query index and it returns:
    {
    "@timestamp": "2024-08-20T16:54:22.842000000Z"
    }

Expected behavior
I expected the ip to be ingested as an ip type.

Configuration:

Quickwit Version: 0.8.2

Index Config:

version: 0.8
index_id: test3
doc_mapping:
    mode: lenient
    timestamp_field: '@timestamp'
    field_mappings:
      - name: '@timestamp'
        type: datetime
        input_formats:
          - iso8601
        output_format: iso8601
        fast_precision: seconds
        fast: true
      - name: client.ip
        type: ip
        fast: true

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.