Version: x-pack filebeat, master branch, commit 87ff5c086
Operating System: Mac OS 10.15.7
Steps to Reproduce:
For my PR #21815, some data is modeled as nested data in order to maintain the proper semantics. Given the example fields.yml entry below, I expect that the fields would be implemented in the Elasticsearch template as properties the same as if the type was marked as group, similar to what is found in the Elasticsearch docs.
The current behavior yields a mapping that relies on dynamic mapping. Unfortunately, in this particular example, sometimes the chi2 property is parsed as an integer, sometimes it is parsed as a float, causing a mapping conflict during ingest of documents.
Example: fields.yml
- name: file.pe.overlay
type: nested
fields:
- name: chi2
description: >
Chi2 information of the PE file.
type: float
- name: entropy
description: >
Entropy information of the PE file.
type: float
- name: filetype
description: >
Filetype of the PE file.
type: keyword
- name: md5
description: >
Overlay MD5 hash of the PE file.
type: keyword
- name: offset
description: >
Offset of the overlay information of the PE file.
type: keyword
- name: size
description: >
Size of the PE file.
format: bytes
type: longActual resulting mapping (trimmed to only include field definition)
"overlay": {
"type": "nested"
},Expected resulting mapping
"overlay": {
"type": "nested",
"properties": {
"chi2": {
"type": "float"
},
"filetype": {
"ignore_above": 1024,
"type": "keyword"
},
"entropy": {
"type": "float"
},
"offset": {
"ignore_above": 1024,
"type": "keyword"
},
"size": {
"type": "long"
},
"md5": {
"ignore_above": 1024,
"type": "keyword"
}
}
},
Version: x-pack filebeat,
masterbranch, commit87ff5c086Operating System: Mac OS 10.15.7
Steps to Reproduce:
For my PR #21815, some data is modeled as nested data in order to maintain the proper semantics. Given the example
fields.ymlentry below, I expect that the fields would be implemented in the Elasticsearch template as properties the same as if the type was marked asgroup, similar to what is found in the Elasticsearch docs.The current behavior yields a mapping that relies on dynamic mapping. Unfortunately, in this particular example, sometimes the
chi2property is parsed as an integer, sometimes it is parsed as a float, causing a mapping conflict during ingest of documents.Example: fields.yml
Actual resulting mapping (trimmed to only include field definition)
Expected resulting mapping