While investigating elastic/kibana#129344 (comment), I found some field definitions for dynamic mappings that seem invalid.
The fields are these ones:
kubernetes.scheduler.pod.preemption.victims.bucket.*azure.auditlogs.target_resources.*azure.auditlogs.target_resources.*.modified_properties.*
They have wildcards, but they don't have type: object, so no dynamic mapping is being installed for them. They are being installed as plain fields with the wildcard as literal part of their names.
For example, the definition for azure.auditlogs.target_resources.*.modified_properties.* is not generating any dynamic mapping, and is generating this:
{
"template": {
"mappings": {
...
"properties": {
...
"azure": {
"properties": {
...
"auditlogs": {
"properties": {
...
"properties": {
...
"target_resources": {
"properties": {
"*": {
"properties": {
"display_name": {
"ignore_above": 1024,
"type": "keyword"
},
"id": {
"ignore_above": 1024,
"type": "keyword"
},
"ip_address": {
"ignore_above": 1024,
"type": "keyword"
},
"modified_properties": {
"properties": {
"*": {
"properties": {
...
}
}
}
},
...
Some possible action points to solve this would be:
- Fix these definitions, so they include
type: object and object_type, so dynamic mappings are generated for them.
- Disallow the use of wildcards (
*) when type: object is not set.
- Do nothing as this hasn't caused user-facing issues so far.
We are discussing about what to do on these cases in Fleet in elastic/kibana#129344 (comment), some ideas may also apply here.
While investigating elastic/kibana#129344 (comment), I found some field definitions for dynamic mappings that seem invalid.
The fields are these ones:
kubernetes.scheduler.pod.preemption.victims.bucket.*azure.auditlogs.target_resources.*azure.auditlogs.target_resources.*.modified_properties.*They have wildcards, but they don't have
type: object, so no dynamic mapping is being installed for them. They are being installed as plain fields with the wildcard as literal part of their names.For example, the definition for
azure.auditlogs.target_resources.*.modified_properties.*is not generating any dynamic mapping, and is generating this:Some possible action points to solve this would be:
type: objectandobject_type, so dynamic mappings are generated for them.*) whentype: objectis not set.We are discussing about what to do on these cases in Fleet in elastic/kibana#129344 (comment), some ideas may also apply here.