Skip to content

Commit 1b8d746

Browse files
romuletsromulets
authored
[9.1] [Entity Store] Remove non ECS complaint identity fields mapping (#226741) (#226955)
# Backport This will backport the following commits from `main` to `9.1`: - [[Entity Store] Remove non ECS complaint identity fields mapping (#226741)](#226741) <!--- Backport version: 10.0.1 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport) <!--BACKPORT [{"author":{"name":"Rômulo Farias","email":"romulo.farias@elastic.co"},"sourceCommit":{"committedDate":"2025-07-07T17:24:16Z","message":"[Entity Store] Remove non ECS complaint identity fields mapping (#226741)\n\n## Summary\n\nIdentity fields (`user.name`, `host.name`, `entity.name` and\n`service.name`) were always defaulting to a mapping with `keyword` and\n`.text` `text` field, while that's not ECS complaint.\n\nThis PR removes `text` field from `host.name`, `entity.name` and\n`service.name` (keeps `user.name`)\n\n- Related to https://github.com/elastic/kibana/issues/226475\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas added for features that require explanation or tutorials\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n- [x] If a plugin configuration key changed, check if it needs to be\nallowlisted in the cloud and added to the [docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n- [x] This was checked for breaking HTTP API changes, and any breaking\nchanges have been approved by the breaking-change committee. The\n`release_note:breaking` label should be applied in these situations.\n- [x] [Flaky Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\nused on any tests changed\n- [x] The PR description includes the appropriate Release Notes section,\nand the correct `release_note:*` label is applied per the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n- [x] Review the [backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand apply applicable `backport:*` labels.\n\n### Identify risks\nNo risk.","sha":"d839f7f2a764202a90c43002c74b7d37a35c52d9","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:version","v9.1.0","v8.19.0","v9.2.0"],"title":"[Entity Store] Remove non ECS complaint identity fields mapping","number":226741,"url":"https://github.com/elastic/kibana/pull/226741","mergeCommit":{"message":"[Entity Store] Remove non ECS complaint identity fields mapping (#226741)\n\n## Summary\n\nIdentity fields (`user.name`, `host.name`, `entity.name` and\n`service.name`) were always defaulting to a mapping with `keyword` and\n`.text` `text` field, while that's not ECS complaint.\n\nThis PR removes `text` field from `host.name`, `entity.name` and\n`service.name` (keeps `user.name`)\n\n- Related to https://github.com/elastic/kibana/issues/226475\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas added for features that require explanation or tutorials\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n- [x] If a plugin configuration key changed, check if it needs to be\nallowlisted in the cloud and added to the [docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n- [x] This was checked for breaking HTTP API changes, and any breaking\nchanges have been approved by the breaking-change committee. The\n`release_note:breaking` label should be applied in these situations.\n- [x] [Flaky Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\nused on any tests changed\n- [x] The PR description includes the appropriate Release Notes section,\nand the correct `release_note:*` label is applied per the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n- [x] Review the [backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand apply applicable `backport:*` labels.\n\n### Identify risks\nNo risk.","sha":"d839f7f2a764202a90c43002c74b7d37a35c52d9"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/226741","number":226741,"mergeCommit":{"message":"[Entity Store] Remove non ECS complaint identity fields mapping (#226741)\n\n## Summary\n\nIdentity fields (`user.name`, `host.name`, `entity.name` and\n`service.name`) were always defaulting to a mapping with `keyword` and\n`.text` `text` field, while that's not ECS complaint.\n\nThis PR removes `text` field from `host.name`, `entity.name` and\n`service.name` (keeps `user.name`)\n\n- Related to https://github.com/elastic/kibana/issues/226475\n\n### Checklist\n\nCheck the PR satisfies following conditions. \n\nReviewers should verify this PR satisfies this list as well.\n\n- [x] Any text added follows [EUI's writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing), uses\nsentence case text and includes [i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n- [x]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas added for features that require explanation or tutorials\n- [x] [Unit or functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere updated or added to match the most common scenarios\n- [x] If a plugin configuration key changed, check if it needs to be\nallowlisted in the cloud and added to the [docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n- [x] This was checked for breaking HTTP API changes, and any breaking\nchanges have been approved by the breaking-change committee. The\n`release_note:breaking` label should be applied in these situations.\n- [x] [Flaky Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was\nused on any tests changed\n- [x] The PR description includes the appropriate Release Notes section,\nand the correct `release_note:*` label is applied per the\n[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)\n- [x] Review the [backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand apply applicable `backport:*` labels.\n\n### Identify risks\nNo risk.","sha":"d839f7f2a764202a90c43002c74b7d37a35c52d9"}}]}] BACKPORT-->
1 parent 95786fc commit 1b8d746

10 files changed

Lines changed: 20 additions & 46 deletions

File tree

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/elasticsearch_assets/entity_index.ts‎

Lines changed: 5 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -65,17 +65,13 @@ export const getEntityIndexStatus = async ({
6565
export type MappingProperties = NonNullable<MappingTypeMapping['properties']>;
6666

6767
export const generateIndexMappings = (
68-
description: Pick<EntityEngineInstallationDescriptor, 'fields' | 'identityField'>
68+
description: Pick<
69+
EntityEngineInstallationDescriptor,
70+
'fields' | 'identityField' | 'identityFieldMapping'
71+
>
6972
): MappingTypeMapping => {
7073
const identityFieldMappings: MappingProperties = {
71-
[description.identityField]: {
72-
type: 'keyword',
73-
fields: {
74-
text: {
75-
type: 'match_only_text',
76-
},
77-
},
78-
},
74+
[description.identityField]: description.identityFieldMapping,
7975
};
8076

8177
const otherFieldMappings = description.fields
@@ -99,11 +95,6 @@ export const BASE_ENTITY_INDEX_MAPPING: MappingProperties = {
9995
},
10096
'entity.name': {
10197
type: 'keyword',
102-
fields: {
103-
text: {
104-
type: 'match_only_text',
105-
},
106-
},
10798
},
10899
'entity.source': {
109100
type: 'keyword',

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_definitions/entity_descriptions/generic.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ export const genericEntityEngineDescription: EntityDescription = {
1515
entityType: 'generic',
1616
version: GENERIC_DEFINITION_VERSION,
1717
identityField: GENERIC_IDENTITY_FIELD,
18+
identityFieldMapping: { type: 'keyword' },
1819
settings: {
1920
timestampField: '@timestamp',
2021
},

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_definitions/entity_descriptions/host.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ export const hostEntityEngineDescription: EntityDescription = {
1515
entityType: 'host',
1616
version: HOST_DEFINITION_VERSION,
1717
identityField: HOST_IDENTITY_FIELD,
18+
identityFieldMapping: { type: 'keyword' },
1819
settings: {
1920
timestampField: '@timestamp',
2021
},

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_definitions/entity_descriptions/service.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ export const serviceEntityEngineDescription: EntityDescription = {
1616
entityType: 'service',
1717
version: SERVICE_DEFINITION_VERSION,
1818
identityField: SERVICE_IDENTITY_FIELD,
19+
identityFieldMapping: { type: 'keyword' },
1920
settings: {
2021
timestampField: '@timestamp',
2122
},

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_definitions/entity_descriptions/user.ts‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,14 @@ export const userEntityEngineDescription: EntityDescription = {
1414
entityType: 'user',
1515
version: USER_DEFINITION_VERSION,
1616
identityField: USER_IDENTITY_FIELD,
17+
identityFieldMapping: {
18+
type: 'keyword',
19+
fields: {
20+
text: {
21+
type: 'match_only_text',
22+
},
23+
},
24+
},
1725
settings: {
1826
timestampField: '@timestamp',
1927
},

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_definitions/types.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ export type EntityDescription = PickPartial<
2323
| 'indexMappings'
2424
| 'settings'
2525
| 'pipeline'
26-
| 'dynamic',
26+
| 'dynamic'
27+
| 'identityFieldMapping',
2728
'indexPatterns' | 'indexMappings' | 'settings' | 'dynamic'
2829
>;

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/entity_store_data_client.test.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ const definition: EntityDefinition = convertToEntityManagerDefinition(
3838
version: '0.0.1',
3939
fields: [],
4040
identityField: 'host.name',
41+
identityFieldMapping: { type: 'keyword' },
4142
indexMappings: {},
4243
indexPatterns: [],
4344
settings: {

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/installation/__snapshots__/engine_description.test.ts.snap‎

Lines changed: 0 additions & 30 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/installation/engine_description.test.ts‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,6 @@ describe('getUnitedEntityDefinition', () => {
6262
expect(entityManagerDefinition).toMatchSnapshot();
6363
});
6464
});
65-
6665
describe('service', () => {
6766
const description = createEngineDescription({
6867
entityType: 'service',

‎x-pack/solutions/security/plugins/security_solution/server/lib/entity_analytics/entity_store/installation/types.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ export interface EntityEngineInstallationDescriptor {
2121
version: string;
2222
entityType: EntityType;
2323
identityField: string;
24+
identityFieldMapping: MappingProperty;
2425

2526
/**
2627
* Default static index patterns to use as the source of entity data.

0 commit comments

Comments
 (0)