Skip to content

[Change Proposal] Properly support or remove the array field type #408

@jsoriano

Description

@jsoriano

The package-spec allows the use of the array field type, but this filed type doesn't exist. Elasticsearch doesn't have any type for arrays. Instead, any field can contain single or multiple values.

This type seems to come from Beats, where it seems to be some kind of convention when multiple values are expected, but it is also not heavily used there.

On integrations, where it is used, it doesn't generate any mapping, what is probably unexpected.

This type should be properly supported or removed.

Option 1: Removing it

We could just remove it on package-spec 2.0.0 (#399), and force package developers to make a decision on these fields when upgrading to this format.
In most of the cases it should be just replaced by the actual type expected there.

Option 2: Add support for it

Fleet should need to implement the generation of mappings for these fields. Following Beats implementation I think that we could translate fields with type: array to type: keyword, and fields with type: array and object_type: something to type: something.

In elastic-package we could add some validation equivalent to the one for array normalization (elastic/elastic-package#765).

Metadata

Metadata

Assignees

Labels

Team:EcosystemLabel for the Packages Ecosystem teamdiscussIssue needs discussion

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions