Import hard-coded list of common fields #1025
Conversation
💔 Build Failed
Expand to view the summary
Build stats
Test stats 🧪
Steps errors
Expand to view the steps failures
|
🌐 Coverage report
|
| - external: ecs | ||
| name: threat.enrichments.indicator.geo.continent_name | ||
| - external: ecs | ||
| name: threat.enrichments.indicator.geo.country_iso_code | ||
| - external: ecs | ||
| name: threat.enrichments.indicator.geo.region_name | ||
| - external: ecs | ||
| name: threat.enrichments.indicator.geo.region_iso_code | ||
| - external: ecs | ||
| name: threat.enrichments.indicator.geo.city_name | ||
| - external: ecs | ||
| name: threat.enrichments.indicator.geo.name | ||
| - external: ecs | ||
| name: threat.enrichments.indicator.geo.location | ||
|
|
||
| - external: ecs | ||
| name: threat.indicator.geo.continent_name | ||
| - external: ecs | ||
| name: threat.indicator.geo.country_iso_code | ||
| - external: ecs | ||
| name: threat.indicator.geo.region_name | ||
| - external: ecs | ||
| name: threat.indicator.geo.region_iso_code | ||
| - external: ecs | ||
| name: threat.indicator.geo.city_name | ||
| - external: ecs | ||
| name: threat.indicator.geo.name | ||
| - external: ecs | ||
| name: threat.indicator.geo.location |
There was a problem hiding this comment.
Is there any reason why threat would need to be included in this? Especially threat.enrichments which would not exist in any datastream outside the ones generated by SIEM rules (alerts indices).
There was a problem hiding this comment.
Looking at the proposed fields to be hardcoded #1018 (comment), there were some ecs external fields like geo.*. However, among the ecs fields there are no fields that start with ^geo.*. Therefore, as a first approach, I just tried to include all the geo fields that I found here: https://github.com/elastic/ecs/blob/main/generated/ecs/ecs_flat.yml
|
Closing this PR in favor of #1073 |
Relates #1018
This PR adds in build time a new file
fields/imported_elastic_package.ymlwith a list of common fields (hard-coded in the code).