Disable indexing for user_agent.original #138
Conversation
All the original fields are not indexed. For consistency the same should be true for user_agent.original.
webmat
left a comment
webmat
left a comment
There was a problem hiding this comment.
Why turn indexing off here?
Sure it may not be the most often used field, but I can still see use cases where kw indexing can be useful.
- exact match filtering on the whole user agent string
- aggregations on typically shorter UA strings from various programming languages, which are often not well supported by UA parsers
| * Remove `log.offset` and `log.line` as too specific for ECS. #131 | ||
| * Remove top level objects `kubernetes` and `tls`. #132 | ||
| * Remove `*.timezone.offset.sec` fields as too specific for ECS at the moment. #134 | ||
| * Set indexing to false for `user_agent.original`. |
There was a problem hiding this comment.
Why turn indexing off here?
Sure it may not be the most often used field, but I can still see use cases where kw indexing can be useful.
- exact match filtering on the whole user agent string
- aggregations on typically shorter UA strings from various programming languages, which are often not well parsed by UA parsers
There was a problem hiding this comment.
I think if we index it by default, it should be text instead of keyword. Not indexing it by default I would hope it saves on space as the user_agent can be pretty extensive.
We can do the same trick here as we do for the keywords. Not index it by default and when someone needs it, he can add .text as a multifield.
There was a problem hiding this comment.
I think turning off indexing here is premature optimization and will cause problems down the line.
At the very least, though, I would change the disabled type to keyword, not text. We need to stop the text indexing on the canonical field.
There was a problem hiding this comment.
For reference, also had a discussion around this here: elastic/beats#8537
For the text type: My assumption so far was that the type does not matter if we don't index. Would be good to know if it matters.
|
Closing in favor of #240 |
2 participants
All the original fields are not indexed. For consistency the same should be true for user_agent.original.