Skip to content

Commit 9017d50

Browse files
XavierMXavierM
authored
fix name without a category or if field end with .text (#78655)
1 parent 3f4e9f4 commit 9017d50

File tree

3 files changed

+107
-36
lines changed

3 files changed

+107
-36
lines changed

‎x-pack/plugins/security_solution/server/search_strategy/index_fields/index.test.ts‎

Lines changed: 81 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,29 @@ describe('Index Fields', () => {
136136
readFromDocValues: false,
137137
esTypes: [],
138138
},
139+
{
140+
aggregatable: true,
141+
category: 'agent',
142+
esTypes: [],
143+
indexes: ['auditbeat'],
144+
name: 'agent.user.name',
145+
readFromDocValues: false,
146+
searchable: true,
147+
type: 'string',
148+
},
149+
{
150+
aggregatable: true,
151+
category: 'client',
152+
description:
153+
'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.',
154+
esTypes: [],
155+
example: 15169,
156+
indexes: ['auditbeat'],
157+
name: 'client.as.number.text',
158+
readFromDocValues: false,
159+
searchable: true,
160+
type: 'string',
161+
},
139162
])
140163
);
141164
});
@@ -149,18 +172,19 @@ describe('Index Fields', () => {
149172
);
150173
expect(fields).toEqual([
151174
{
175+
category: 'base',
152176
description: 'Each document has an _id that uniquely identifies it',
153177
example: 'Y-6TfmcB0WOhS6qyMv3s',
154178
name: '_id',
155179
type: 'string',
156180
searchable: true,
157181
aggregatable: false,
158182
readFromDocValues: false,
159-
category: 'base',
160-
indexes: ['auditbeat'],
161183
esTypes: [],
184+
indexes: ['auditbeat'],
162185
},
163186
{
187+
category: 'base',
164188
description:
165189
'An index is like a ‘database’ in a relational database. It has a mapping which defines multiple types. An index is a logical namespace which maps to one or more primary shards and can have zero or more replica shards.',
166190
example: 'auditbeat-8.0.0-2019.02.19-000001',
@@ -169,212 +193,234 @@ describe('Index Fields', () => {
169193
searchable: true,
170194
aggregatable: true,
171195
readFromDocValues: false,
172-
category: 'base',
173-
indexes: ['auditbeat'],
174196
esTypes: [],
197+
indexes: ['auditbeat'],
175198
},
176199
{
200+
category: 'base',
177201
description:
178202
'Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.',
179203
example: '2016-05-23T08:05:34.853Z',
180204
name: '@timestamp',
181205
type: 'date',
182206
searchable: true,
183207
aggregatable: true,
184-
category: 'base',
185-
indexes: ['auditbeat'],
186208
readFromDocValues: true,
187209
esTypes: [],
210+
indexes: ['auditbeat'],
188211
},
189212
{
213+
category: 'agent',
190214
description:
191215
'Ephemeral identifier of this agent (if one exists). This id normally changes across restarts, but `agent.id` does not.',
192216
example: '8a4f500f',
193217
name: 'agent.ephemeral_id',
194218
type: 'string',
195219
searchable: true,
196220
aggregatable: true,
197-
category: 'agent',
198-
indexes: ['auditbeat'],
199221
readFromDocValues: false,
200222
esTypes: [],
223+
indexes: ['auditbeat'],
201224
},
202225
{
226+
category: 'agent',
203227
description:
204228
'Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.',
205229
example: 'foo',
206230
name: 'agent.name',
207231
type: 'string',
208232
searchable: true,
209233
aggregatable: true,
210-
category: 'agent',
211-
indexes: ['auditbeat'],
212234
readFromDocValues: false,
213235
esTypes: [],
236+
indexes: ['auditbeat'],
214237
},
215238
{
239+
category: 'agent',
216240
description:
217241
'Type of the agent. The agent type stays always the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.',
218242
example: 'filebeat',
219243
name: 'agent.type',
220244
type: 'string',
221245
searchable: true,
222246
aggregatable: true,
223-
category: 'agent',
224-
indexes: ['auditbeat'],
225247
readFromDocValues: false,
226248
esTypes: [],
249+
indexes: ['auditbeat'],
227250
},
228251
{
252+
category: 'agent',
229253
description: 'Version of the agent.',
230254
example: '6.0.0-rc2',
231255
name: 'agent.version',
232256
type: 'string',
233257
searchable: true,
234258
aggregatable: true,
259+
readFromDocValues: false,
260+
esTypes: [],
261+
indexes: ['auditbeat'],
262+
},
263+
{
235264
category: 'agent',
265+
name: 'agent.user.name',
266+
searchable: true,
267+
type: 'string',
268+
aggregatable: true,
269+
readFromDocValues: false,
270+
esTypes: [],
236271
indexes: ['auditbeat'],
272+
},
273+
{
274+
category: 'client',
275+
description:
276+
'Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.',
277+
example: 15169,
278+
name: 'client.as.number.text',
279+
type: 'string',
280+
searchable: true,
281+
aggregatable: true,
237282
readFromDocValues: false,
238283
esTypes: [],
284+
indexes: ['auditbeat'],
239285
},
240286
{
287+
category: 'base',
241288
description: 'Each document has an _id that uniquely identifies it',
242289
example: 'Y-6TfmcB0WOhS6qyMv3s',
243290
name: '_id',
244291
type: 'string',
245292
searchable: true,
246293
aggregatable: false,
247-
category: 'base',
248-
indexes: ['filebeat'],
249294
readFromDocValues: false,
250295
esTypes: [],
296+
indexes: ['filebeat'],
251297
},
252298
{
299+
category: 'base',
253300
description:
254301
'An index is like a ‘database’ in a relational database. It has a mapping which defines multiple types. An index is a logical namespace which maps to one or more primary shards and can have zero or more replica shards.',
255302
example: 'auditbeat-8.0.0-2019.02.19-000001',
256303
name: '_index',
257304
type: 'string',
258305
searchable: true,
259306
aggregatable: true,
260-
category: 'base',
261-
indexes: ['filebeat'],
262307
readFromDocValues: false,
263308
esTypes: [],
309+
indexes: ['filebeat'],
264310
},
265311
{
312+
category: 'base',
266313
description:
267314
'Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.',
268315
example: '2016-05-23T08:05:34.853Z',
269316
name: '@timestamp',
270317
type: 'date',
271318
searchable: true,
272319
aggregatable: true,
273-
category: 'base',
274-
indexes: ['filebeat'],
275320
readFromDocValues: true,
276321
esTypes: [],
322+
indexes: ['filebeat'],
277323
},
278324
{
325+
category: 'agent',
279326
description:
280327
'Deprecated - use agent.name or agent.id to identify an agent. Hostname of the agent. ',
281328
name: 'agent.hostname',
282-
searchable: true,
283329
type: 'string',
330+
searchable: true,
284331
aggregatable: true,
285-
category: 'agent',
286-
indexes: ['filebeat'],
287332
readFromDocValues: false,
288333
esTypes: [],
334+
indexes: ['filebeat'],
289335
},
290336
{
337+
category: 'agent',
291338
description:
292339
'Custom name of the agent. This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. If no name is given, the name is often left empty.',
293340
example: 'foo',
294341
name: 'agent.name',
295342
type: 'string',
296343
searchable: true,
297344
aggregatable: true,
298-
category: 'agent',
299-
indexes: ['filebeat'],
300345
readFromDocValues: false,
301346
esTypes: [],
347+
indexes: ['filebeat'],
302348
},
303349
{
350+
category: 'agent',
304351
description: 'Version of the agent.',
305352
example: '6.0.0-rc2',
306353
name: 'agent.version',
307354
type: 'string',
308355
searchable: true,
309356
aggregatable: true,
310-
category: 'agent',
311-
indexes: ['filebeat'],
312357
readFromDocValues: false,
313358
esTypes: [],
359+
indexes: ['filebeat'],
314360
},
315361
{
362+
category: 'base',
316363
description: 'Each document has an _id that uniquely identifies it',
317364
example: 'Y-6TfmcB0WOhS6qyMv3s',
318365
name: '_id',
319366
type: 'string',
320367
searchable: true,
321368
aggregatable: false,
322-
category: 'base',
323-
indexes: ['packetbeat'],
324369
readFromDocValues: false,
325370
esTypes: [],
371+
indexes: ['packetbeat'],
326372
},
327373
{
374+
category: 'base',
328375
description:
329376
'An index is like a ‘database’ in a relational database. It has a mapping which defines multiple types. An index is a logical namespace which maps to one or more primary shards and can have zero or more replica shards.',
330377
example: 'auditbeat-8.0.0-2019.02.19-000001',
331378
name: '_index',
332379
type: 'string',
333380
searchable: true,
334381
aggregatable: true,
335-
category: 'base',
336-
indexes: ['packetbeat'],
337382
readFromDocValues: false,
338383
esTypes: [],
384+
indexes: ['packetbeat'],
339385
},
340386
{
387+
category: 'base',
341388
description:
342389
'Date/time when the event originated. This is the date/time extracted from the event, typically representing when the event was generated by the source. If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline. Required field for all events.',
343390
example: '2016-05-23T08:05:34.853Z',
344391
name: '@timestamp',
345392
type: 'date',
346393
searchable: true,
347394
aggregatable: true,
348-
category: 'base',
349-
indexes: ['packetbeat'],
350395
readFromDocValues: true,
351396
esTypes: [],
397+
indexes: ['packetbeat'],
352398
},
353399
{
400+
category: 'agent',
354401
description:
355402
'Unique identifier of this agent (if one exists). Example: For Beats this would be beat.id.',
356403
example: '8a4f500d',
357404
name: 'agent.id',
358405
type: 'string',
359406
searchable: true,
360407
aggregatable: true,
361-
category: 'agent',
362-
indexes: ['packetbeat'],
363408
readFromDocValues: false,
364409
esTypes: [],
410+
indexes: ['packetbeat'],
365411
},
366412
{
413+
category: 'agent',
367414
description:
368415
'Type of the agent. The agent type stays always the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.',
369416
example: 'filebeat',
370417
name: 'agent.type',
371418
type: 'string',
372419
searchable: true,
373420
aggregatable: true,
374-
category: 'agent',
375-
indexes: ['packetbeat'],
376421
readFromDocValues: false,
377422
esTypes: [],
423+
indexes: ['packetbeat'],
378424
},
379425
]);
380426
});

‎x-pack/plugins/security_solution/server/search_strategy/index_fields/index.ts‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,17 @@ export const createFieldItem = (
121121
indexesAliasIdx: number
122122
): IndexField => {
123123
const alias = indexesAlias[indexesAliasIdx];
124+
const splitIndexName = index.name.split('.');
125+
const indexName =
126+
splitIndexName[splitIndexName.length - 1] === 'text'
127+
? splitIndexName.slice(0, splitIndexName.length - 1).join('.')
128+
: index.name;
129+
const beatIndex = fieldsBeat[indexName] ?? {};
130+
if (isEmpty(beatIndex.category)) {
131+
beatIndex.category = splitIndexName[0];
132+
}
124133
return {
125-
...(fieldsBeat[index.name] ?? {}),
134+
...beatIndex,
126135
...index,
127136
indexes: [alias],
128137
};

‎x-pack/plugins/security_solution/server/search_strategy/index_fields/mock.ts‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,22 @@ export const mockAuditbeatIndexField: FieldDescriptor[] = [
4848
readFromDocValues: false,
4949
esTypes: [],
5050
},
51+
{
52+
name: 'agent.user.name',
53+
searchable: true,
54+
type: 'string',
55+
aggregatable: true,
56+
readFromDocValues: false,
57+
esTypes: [],
58+
},
59+
{
60+
name: 'client.as.number.text',
61+
searchable: true,
62+
type: 'string',
63+
aggregatable: true,
64+
readFromDocValues: false,
65+
esTypes: [],
66+
},
5167
];
5268

5369
export const mockFilebeatIndexField: FieldDescriptor[] = [

0 commit comments

Comments
 (0)