Skip to content

Add support for an optional value in discovery fields#917

Merged
mrodm merged 11 commits intoelastic:mainfrom
mrodm:add-discovery-field-value
Jul 3, 2025
Merged

Add support for an optional value in discovery fields#917
mrodm merged 11 commits intoelastic:mainfrom
mrodm:add-discovery-field-value

Conversation

@mrodm
Copy link
Copy Markdown
Contributor

@mrodm mrodm commented Jul 1, 2025

What does this PR do?

Allow to declare discovery fields rules matching specific values.
Example of discovery field defining a specific value for a field:

discovery:
  fields:
    - name: "data_stream.dataset"
      value: "nginx.access"

Why is it important?

It will allow to show packages that use certain fields and also show packages that use fields with some specific data.

Checklist

  • I have added test packages to test/packages that prove my change is effective.
  • I have added an entry in spec/changelog.yml.
  • The discovery.fields spec in manifest.yml supports an optional value field
  • Multiple discovery field/value pairs can be defined.
  • Backward compatibility is maintained for discovery entries that only specify name

Related issues

@mrodm mrodm self-assigned this Jul 1, 2025
"conditions.kibana.version must be ^8.8.0 or greater for non experimental input packages (version > 1.0.0)",
},
"httpjson_input": []string{
"httpjson_input": {
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remove these types to be as other cases in other tests.

Comment on lines +16 to +19
discovery:
fields:
- name: 12345
- value: nginx.access
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Examples of incorrect discovery fields:

  • name must be a string.
  • a discovery field must contain a name field. value field is the optional one.

@mrodm mrodm changed the title Add discovery field value Add support for an optional value in discovery fields Jul 1, 2025
- true
- 12345
required:
- name
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ensure that name is always set in each array item.

name:
description: Name of the field.
type: string
value:
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Following the same as mentioned in this link: https://github.com/elastic/package-spec/pull/915/files#r2178695513

@kpollich could this new field be ignored by the current Kibana version ? or could it cause any issue ?

Depending on that, it should be added to the following patch version 3.4.1-next or add it to the following minor 3.5.0-next.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This field will be ignored by Kibana IIUC - there are no user-facing features that make use of the discovery fields in Kibana right now so we are free to make this change without considering impact to Kibana.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perfect, then I think it can be kept as 3.4.1-next

@mrodm mrodm marked this pull request as ready for review July 2, 2025 08:12
@mrodm mrodm requested a review from a team as a code owner July 2, 2025 08:12
Comment on lines +29 to +30
- type: string
minLength: 1
Copy link
Copy Markdown
Contributor Author

@mrodm mrodm Jul 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here, I'm forcing that if it is a string, it should not be an empty string.

For instance, this would not be allowed:

discovery:
  fields:
    - name: event.dataset
      value: ""

Would that make sense ?
Or, should we allow to compare a field with an empty string?

Depending on that, the validation in EPR could be different.

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we allow to compare a field with an empty string?

I guess this is in theory possible, but I don't know what would be the use case. So feel free to keep this minLength.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking around the spec, there is no usage of this minLength for other string values.
As you mention, I don't know of any use case where it is required to look for a package that a given field is empty. So, I'll keep that minLength for now.

jsoriano
jsoriano previously approved these changes Jul 2, 2025
Comment on lines +29 to +30
- type: string
minLength: 1
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should we allow to compare a field with an empty string?

I guess this is in theory possible, but I don't know what would be the use case. So feel free to keep this minLength.

Co-authored-by: Jaime Soriano Pastor <jaime.soriano@elastic.co>
@elasticmachine
Copy link
Copy Markdown

💚 Build Succeeded

History

cc @mrodm

@mrodm mrodm requested a review from jsoriano July 3, 2025 08:44
@mrodm mrodm merged commit 71b0d42 into elastic:main Jul 3, 2025
3 checks passed
@mrodm mrodm deleted the add-discovery-field-value branch July 3, 2025 13:55
mrodm added a commit that referenced this pull request Jul 8, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants