Situation
The ecs@mappings component template supports all the fields in ECS.
For date fields, it supports the following naming conventions:
|
{ |
|
"ecs_date": { |
|
"mapping": { |
|
"type": "date" |
|
}, |
|
"path_match": [ |
|
"*.timestamp", |
|
"*_timestamp", |
|
"*.not_after", |
|
"*.not_before", |
|
"*.accessed", |
|
"created", |
|
"*.created", |
|
"*.installed", |
|
"*.creation_date", |
|
"*.ctime", |
|
"*.mtime", |
|
"ingested", |
|
"*.ingested", |
|
"*.start", |
|
"*.end" |
|
], |
|
"unmatch_mapping_type": "object" |
|
} |
|
}, |
Problem
The mapping works in all circumstances for the date fields that match the above naming convention.
However, other data fields do not match this naming convention:
threat.indicator.first_seen
threat.indicator.last_seen
threat.indicator.modified_at
threat.enrichments.indicator.modified_at
threat.enrichments.matched.occurred
threat.enrichments.indicator.first_seen
threat.enrichments.indicator.last_seen
These fields are generally mapped as dates thanks to the date_detection dynamic field mapping option, enabled by default.
If date_detection is disabled, Elasticsearch will not map these fields as date, creating unexpected mapping problems.
Conslusion
ecs@mappings should support all the data fields in ECS by extending the naming convention, even if integration devs or end users disable date_detection for any reason.
References
Situation
The ecs@mappings component template supports all the fields in ECS.
For date fields, it supports the following naming conventions:
elasticsearch/x-pack/plugin/core/template-resources/src/main/resources/ecs@mappings.json
Lines 138 to 162 in 212fe03
Problem
The mapping works in all circumstances for the date fields that match the above naming convention.
However, other data fields do not match this naming convention:
These fields are generally mapped as dates thanks to the date_detection dynamic field mapping option, enabled by default.
If date_detection is disabled, Elasticsearch will not map these fields as date, creating unexpected mapping problems.
Conslusion
ecs@mappings should support all the data fields in ECS by extending the naming convention, even if integration devs or end users disable date_detection for any reason.
References