+ [Exclude](#exclude)

Use the `--exclude` flag to generate ephemeral ECS artifacts based on the current ECS schema field definitions minus fields considered for removal, e.g. to assess impact of removing these. Warning! This is not the recommended route to remove a field permanently as it is not intentended to be invoked during the build process. Definitive field removal should be implemented using a custom [Subset](#subset) or via the [RFC process](https://github.com/elastic/ecs/tree/master/rfcs/README.md). Example:

The `--exclude` flag expects a path to one or more YAML files using the same [file format](https://github.com/elastic/ecs/tree/master/schemas#fields-supported-in-schemasyml) as the ECS schema files. You can also use a subset, provided that relevant `name` and `fields` fields are preserved.

The root Field Set `name` must always be present and specified with no dots `.`. Subfields may be specified using dot notation, for example:

Generate artifacts using `--exclude` to load our custom definitions in addition to `--out` to place them in the desired output directory:

from schema import exclude_filter

fields = exclude_filter.exclude(fields, args.exclude)

if args.include or args.subset or args.exclude:

parser.add_argument('--exclude', nargs='+',

help='exclude user specified subset of the schema')

return """

""".lstrip()

"""Subtract two lists. original = subtracted"""

"""Encapsulates the check to see if a field is an intermediate field or a "real" field."""

"""

"""Generate ecs_flat.yml"""

"""Visitor function that accumulates all field details in the memo dict"""

"""Generate ecs_nested.yml"""

"""Remove attributes only relevant to the deeply nested structure, but not to ecs_flat/nested.yml."""

"""

"""Ensures for the presence of the mandatory schema attributes and raises if any are missing"""

"""Additional checks on a fleshed out schema"""

"""Sets datatype-related defaults on a canonical field or multi-field entries."""

"""Ensures for the presence of the mandatory field attributes and raises if any are missing"""

"""Additional checks on a fleshed out field"""

from schema import loader

def exclude(fields, exclude_file_globs):

excludes = load_exclude_definitions(exclude_file_globs)

if excludes:

fields = exclude_fields(fields, excludes)

return fields

def long_path(path_as_list):

return '.'.join([e for e in path_as_list])

def pop_field(fields, node_path, path, removed):

"""pops a field from yaml derived dict using path derived from ordered list of nodes"""

if node_path[0] in fields:

if len(node_path) == 1:

flat_name = long_path(path)

fields.pop(node_path[0])

return flat_name

else:

inner_field = node_path.pop(0)

if 'fields' in fields[inner_field]:

popped = pop_field(fields[inner_field]['fields'], node_path, path, removed)

# if object field with no remaining fields and not 'base', pop it

if fields[inner_field]['fields'] == {} and inner_field != 'base':

fields.pop(inner_field)

return popped

else:

raise ValueError(

'--exclude specified, but no path to field {} found'.format(long_path(path)))

else:

this_long_path = long_path(path)

# Check in case already removed parent

if not any([this_long_path.startswith(long_path) for long_path in removed if long_path != None]):

raise ValueError('--exclude specified, but no field {} found'.format(this_long_path))

def exclude_trace_path(fields, item, path, removed):

"""traverses paths to one or more nodes in a yaml derived dict"""

for list_item in item:

node_path = path.copy()

# cater for name.with.dots

for name in list_item['name'].split('.'):

node_path.append(name)

if not 'fields' in list_item:

parent = node_path[0]

removed.append(pop_field(fields, node_path, node_path.copy(), removed))

# if parent field has no remaining fields and not 'base', pop it

if parent != 'base' and parent in fields and len(fields[parent]['fields']) == 0:

fields.pop(parent)

else:

raise ValueError('--exclude specified, can\'t parse fields in file {}'.format(item))

def exclude_fields(fields, excludes):

"""Traverses fields and eliminates any field which matches the excludes"""

if excludes:

for ex_list in excludes:

for item in ex_list:

exclude_trace_path(fields, item['fields'], [item['name']], [])

return fields

def load_exclude_definitions(file_globs):

if not file_globs:

return []

excludes = loader.load_definitions(file_globs)

if not excludes:

raise ValueError('--exclude specified, but no exclusions found in {}'.format(file_globs))

return excludes

"""Intended entrypoint of the finalizer."""

"""Performs field reuse in two phases"""

"""

"""Captures two ways of denoting what field sets are reused under a given field set"""

"""Recursively set the 'original_fieldset' attribute for all fields in a group of fields"""

"""Returns the ['fields'] hash at the dotted_path."""

"""

"""This is the function called by the visitor to perform the work of calculate_final_values"""