Skip to content

[mimecast] Field data type conflicts between data streams #13586

@andrewkroh

Description

@andrewkroh

There are a few fields declared with varying data types across the mimecast package. These can cause Kibana data view conflicts.

  • mimecast.taggedExternal has multiple data types (boolean, keyword)
  • mimecast.taggedMalicious has multiple data types (boolean, keyword)

$  go run github.com/andrewkroh/fydler@v0.0.0-20250415153911-026c7419e440 -a conflict -conflict.ignore-text-family -conflict.ignore-keyword-family -i  packages/mimecast packages/**/fields/*.yml
packages/mimecast/data_stream/ttp_ip_logs/fields/field.yml:34:7 mimecast.taggedExternal has multiple data types (boolean, keyword) (conflict)
  packages/mimecast/data_stream/ttp_ip_logs/fields/field.yml:34:7 boolean (conflict)
  packages/mimecast/data_stream/siem_logs/fields/field.yml:438:7 keyword (conflict)
packages/mimecast/data_stream/ttp_ip_logs/fields/field.yml:7:7 mimecast.taggedMalicious has multiple data types (boolean, keyword) (conflict)
  packages/mimecast/data_stream/ttp_ip_logs/fields/field.yml:7:7 boolean (conflict)
  packages/mimecast/data_stream/siem_logs/fields/field.yml:434:7 keyword (conflict)

Metadata

Metadata

Labels

Integration:mimecastMimecast (Partner supported)Team:SDE-CrestCrest developers on the Security Integrations team [elastic/sit-crest-contractors]Team:Security-Service IntegrationsSecurity Service Integrations team [elastic/security-service-integrations]bugSomething isn't working, use only for issuesmaintainer:PartnerPartner supported integration

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions