The package-spec allows the use of the array field type, but this filed type doesn't exist. Elasticsearch doesn't have any type for arrays. Instead, any field can contain single or multiple values.
This type seems to come from Beats, where it seems to be some kind of convention when multiple values are expected, but it is also not heavily used there.
On integrations, where it is used, it doesn't generate any mapping, what is probably unexpected.
This type should be properly supported or removed.
Option 1: Removing it
We could just remove it on package-spec 2.0.0 (#399), and force package developers to make a decision on these fields when upgrading to this format.
In most of the cases it should be just replaced by the actual type expected there.
Option 2: Add support for it
Fleet should need to implement the generation of mappings for these fields. Following Beats implementation I think that we could translate fields with type: array to type: keyword, and fields with type: array and object_type: something to type: something.
In elastic-package we could add some validation equivalent to the one for array normalization (elastic/elastic-package#765).
The package-spec allows the use of the
arrayfield type, but this filed type doesn't exist. Elasticsearch doesn't have any type for arrays. Instead, any field can contain single or multiple values.This type seems to come from Beats, where it seems to be some kind of convention when multiple values are expected, but it is also not heavily used there.
On integrations, where it is used, it doesn't generate any mapping, what is probably unexpected.
This type should be properly supported or removed.
Option 1: Removing it
We could just remove it on package-spec 2.0.0 (#399), and force package developers to make a decision on these fields when upgrading to this format.
In most of the cases it should be just replaced by the actual type expected there.
Option 2: Add support for it
Fleet should need to implement the generation of mappings for these fields. Following Beats implementation I think that we could translate fields with
type: arraytotype: keyword, and fields withtype: arrayandobject_type: somethingtotype: something.In elastic-package we could add some validation equivalent to the one for array normalization (elastic/elastic-package#765).