You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Version: x-pack filebeat, master branch, commit 87ff5c086 Operating System: Mac OS 10.15.7 Steps to Reproduce:
For my PR #21815, some data is modeled as nested data in order to maintain the proper semantics. Given the example fields.yml entry below, I expect that the fields would be implemented in the Elasticsearch template as properties the same as if the type was marked as group, similar to what is found in the Elasticsearch docs.
The current behavior yields a mapping that relies on dynamic mapping. Unfortunately, in this particular example, sometimes the chi2 property is parsed as an integer, sometimes it is parsed as a float, causing a mapping conflict during ingest of documents.
Example: fields.yml
- name: file.pe.overlaytype: nestedfields:
- name: chi2description: > Chi2 information of the PE file.type: float
- name: entropydescription: > Entropy information of the PE file.type: float
- name: filetypedescription: > Filetype of the PE file.type: keyword
- name: md5description: > Overlay MD5 hash of the PE file.type: keyword
- name: offsetdescription: > Offset of the overlay information of the PE file.type: keyword
- name: sizedescription: > Size of the PE file.format: bytestype: long
Actual resulting mapping (trimmed to only include field definition)
Version: x-pack filebeat,
master
branch, commit87ff5c086
Operating System: Mac OS 10.15.7
Steps to Reproduce:
For my PR #21815, some data is modeled as nested data in order to maintain the proper semantics. Given the example
fields.yml
entry below, I expect that the fields would be implemented in the Elasticsearch template as properties the same as if the type was marked asgroup
, similar to what is found in the Elasticsearch docs.The current behavior yields a mapping that relies on dynamic mapping. Unfortunately, in this particular example, sometimes the
chi2
property is parsed as an integer, sometimes it is parsed as a float, causing a mapping conflict during ingest of documents.Example: fields.yml
Actual resulting mapping (trimmed to only include field definition)
Expected resulting mapping
The text was updated successfully, but these errors were encountered: