💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

I admit that it wasn't easy to go through the logic :) Maybe it's the first symptom to refactor the fields code.

Yeah, this is the first time we need to validate the values of two fields at the same time, this is why I ended up passing the whole document through all the calls chain so when validating one field we can check the value of the other.

Two possible alternatives would be:

• Internally instantiate a document validator for each document, this validator could keep state for each document validation, or the document itself.
• Given that by now we only need this for the event.type and event.category fields, validate them explicitly in ValidateDocumentMap, but this would give special consideration to these fields, what can be tricky in the future if ECS decides to use expected_event_types in other fields apart of event.category.

🌐 Coverage report

Frankly speaking, both propositions are rather hackish. I think that I'd rather keep your current proposal (PR).

Yep, I also prefer the current approach even if not so nice to have to pass the document around.

Integration tests found an issue, event.type is defined as array in ECS. Fixed code and tests to cover this case. Apache package fixed, it was missing event.type in one data stream.

After this change I will start with #963.