[Fleet] Generate dynamic template mappings for field with wildcard in name (#137978)

nchaulet · web-flow · commit 88eae3ef401d · 2022-08-03T14:04:07.000-04:00
diff --git a/x-pack/plugins/fleet/server/services/epm/fields/field.test.ts b/x-pack/plugins/fleet/server/services/epm/fields/field.test.ts
@@ -624,4 +624,50 @@ describe('processFields', () => {
     ];
     expect(processFields(fields)).toEqual(fieldsExpected);
   });
+
+  test('handle wildcard field', () => {
+    const wildcardFields = [
+      {
+        name: 'a.*.b',
+        type: 'keyword',
+      },
+      {
+        name: 'a.b.*',
+        type: 'scaled_float',
+      },
+    ];
+
+    expect(processFields(wildcardFields)).toMatchInlineSnapshot(`
+      [
+        {
+          "name": "a",
+          "type": "group",
+          "fields": [
+            {
+              "name": "*",
+              "type": "group",
+              "fields": [
+                {
+                  "name": "b",
+                  "type": "object",
+                  "object_type": "keyword"
+                }
+              ]
+            },
+            {
+              "name": "b",
+              "type": "group",
+              "fields": [
+                {
+                  "name": "*",
+                  "type": "object",
+                  "object_type": "scaled_float"
+                }
+              ]
+            }
+          ]
+        }
+      ]
+    `);
+  });
 });
diff --git a/x-pack/plugins/fleet/server/services/epm/fields/field.ts b/x-pack/plugins/fleet/server/services/epm/fields/field.ts
@@ -246,8 +246,23 @@ export const getField = (fields: Fields, pathNames: string[]): Field | undefined
   return undefined;
 };
 
+export function processFieldsWithWildcard(fields: Fields): Fields {
+  const newFields: Fields = [];
+  for (const field of fields) {
+    const hasWildcard = field.name.includes('*');
+    const hasObjectType = field.object_type;
+    if (hasWildcard && !hasObjectType) {
+      newFields.push({ ...field, type: 'object', object_type: field.type });
+    } else {
+      newFields.push({ ...field });
+    }
+  }
+  return newFields;
+}
+
 export function processFields(fields: Fields): Fields {
-  const expandedFields = expandFields(fields);
+  const processedFields = processFieldsWithWildcard(fields);
+  const expandedFields = expandFields(processedFields);
   const dedupedFields = dedupFields(expandedFields);
   return validateFields(dedupedFields, dedupedFields);
 }
