[Fleet] Do not set ignore_above for index:false (#141442)

elastic · Sep 22, 2022 · e8e1203 · e8e1203
1 parent fa661a4
commit e8e1203
Show file tree

Hide file tree

Showing 4 changed files with 116 additions and 110 deletions.
diff --git a/...gins/fleet/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap b/...gins/fleet/server/services/epm/elasticsearch/template/__snapshots__/template.test.ts.snap
diff --git a/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/mappings.ts b/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/mappings.ts
@@ -8,6 +8,7 @@
 import type { Field } from '../../fields/field';
 
 const DEFAULT_SCALING_FACTOR = 1000;
+const DEFAULT_IGNORE_ABOVE = 1024;
 
 interface Properties {
   [key: string]: any;
@@ -46,3 +47,27 @@ export function histogram(field: Field): Properties {
 
   return fieldProps;
 }
+
+export function keyword(field: Field): Properties {
+  const fieldProps = getDefaultProperties(field);
+  fieldProps.type = 'keyword';
+
+  if (field.ignore_above) {
+    fieldProps.ignore_above = field.ignore_above;
+  } else {
+    fieldProps.ignore_above = DEFAULT_IGNORE_ABOVE;
+  }
+  if (field.normalizer) {
+    fieldProps.normalizer = field.normalizer;
+  }
+  if (field.dimension) {
+    fieldProps.time_series_dimension = field.dimension;
+    delete fieldProps.ignore_above;
+  }
+
+  if (field.index === false || field.doc_values === false) {
+    delete fieldProps.ignore_above;
+  }
+
+  return fieldProps;
+}
diff --git a/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.test.ts b/x-pack/plugins/fleet/server/services/epm/elasticsearch/template/template.test.ts
@@ -177,7 +177,6 @@ describe('EPM template', () => {
     const keywordWithIndexFalseMapping = {
       properties: {
         keywordIndexFalse: {
-          ignore_above: 1024,
           type: 'keyword',
           doc_values: false,
         },