updating waf tests

gizas · gizas · commit d5a7e022a993 · 2025-02-11T17:43:26.000+02:00
Signed-off-by: Andreas Gkizas &lt;andreas.gkizas@elastic.co&gt;
diff --git a/packages/aws/data_stream/waf/_dev/test/system/test-default-config.yml b/packages/aws/data_stream/waf/_dev/test/system/test-default-config.yml
@@ -7,11 +7,7 @@ vars:
 skip_ignored_fields:
   - aws.waf.terminating_rule_match_details.location
   - aws.waf.non_terminating_matching_rules.ruleMatchDetails.location
-  - aws.waf.non_terminating_matching_rules.ruleMatchDetails.action
-  - aws.waf.terminating_rule_match_details.conditionType
   - aws.waf.rule_group_list.nonTerminatingMatchingRules.ruleMatchDetails.location
-  - aws.waf.rule_group_list.terminatingRule.ruleId
-  - aws.waf.terminating_rule_match_details.matchedData
 data_stream:
   vars:
     queue_url: "{{TF_OUTPUT_queue_url}}"
diff --git a/packages/aws/data_stream/waf/fields/fields.yml b/packages/aws/data_stream/waf/fields/fields.yml
@@ -13,10 +13,59 @@
       type: nested
       description: |
         The list of non-terminating rules in the rule group that match the request. These are always COUNT rules (non-terminating rules that match)
+      fields:
+        - name: action
+          type: keyword
+        - name: ruleId
+          type: keyword
+        - name: ruleMatchDetails
+          type: nested
+          fields:
+            - name: conditionType
+              type: keyword
+            - name: location
+              type: keyword
+            - name: matchedData
+              type: keyword
+    - name: rule_group_list
+      type: nested
+      fields:
+        - name: nonTerminatingMatchingRules
+          type: nested
+          fields:
+            - name: action
+              type: keyword
+            - name: ruleId
+              type: keyword
+            - name: ruleMatchDetails
+              type: nested
+              fields:
+                - name: conditionType
+                  type: keyword
+                - name: location
+                  type: keyword
+                - name: matchedData
+                  type: keyword
+        - name: ruleGroupId
+          type: keyword
+        - name: terminatingRule
+          type: group
+          fields:
+            - name: action
+              type: keyword
+            - name: ruleId
+              type: keyword
     - name: rate_based_rule_list
       type: nested
       description: |
         The list of rate-based rules that acted on the request.
+      fields:
+        - name: conditionType
+          type: keyword
+        - name: location
+          type: keyword
+        - name: matchedData
+          type: keyword
     - name: request.headers
       type: flattened
       description: |
