Skip to content

[Fleet] Add support for runtime fields in packages #155255

@mrodm

Description

@mrodm

Add support for runtime fields in packages.

It is requested in elastic/package-spec#39

Fields in packages could define a new key runtime that could have two possible types of values:

  • boolean: if it is true, add this field as a runtime field, without any script. According to the docs, it will look for a field with the same name in _source (docs).
  • string: if a string is used, then add this field as a runtime field using that string as the script used to calculate the value.

Examples:

- name: foo.bar
  type: long
  runtime: true
- name: foo.baz
  type: long
  runtime: |
    doc['message'].value().doSomething()

Example index mapping to be generated:

{
  "mappings": {
    "runtime": {
      "foo.baz": {
        "type": "long",
        "script": {
          "source": "doc['message'].value().doSomething()"
        }
      }
    },
    "properties": {
     ...
    }
  }
}

Note: To be checked how properties like foo.baz should be resolved in runtime mappings.

Implementation:

  • Add the runtime mapping to the Fleet template generation logic here when runtime is set on the package field.
  • Manual test with test packages containing runtime: true and runtime: <script> to verify the correct mapping is generated
  • Add unit tests and integration tests to cover the scenarios above.

Metadata

Metadata

Assignees

Labels

Team:FleetTeam label for Observability Data Collection Fleet team

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions