[Logs+] Adding ECS dynamic templates (#96171)

elastic · Jun 7, 2023 · 183c0a5 · 183c0a5
1 parent 2345873
commit 183c0a5
Show file tree

Hide file tree

Showing 11 changed files with 665 additions and 9 deletions.
diff --git a/docs/changelog/96171.yaml b/docs/changelog/96171.yaml
@@ -0,0 +1,6 @@
+pr: 96171
+summary: "Adding ECS dynamic mappings component and applying it to logs data streams by default"
+area: Data streams
+type: enhancement
+issues:
+ - 95538
diff --git a/...ms/src/yamlRestTest/resources/rest-api-spec/test/data_stream/210_logs_custom_mappings.yml b/...ms/src/yamlRestTest/resources/rest-api-spec/test/data_stream/210_logs_custom_mappings.yml
@@ -13,6 +13,10 @@
               properties:
                 numeric_field:
                   type: integer
+                socket:
+                  properties:
+                    ip:
+                      type: keyword
 
   - do:
       indices.create_data_stream:
@@ -35,3 +39,33 @@
         index: $idx0name
   # verify that the new field from the custom component template is applied
   - match: { .$idx0name.mappings.properties.numeric_field.type: "integer" }
+
+  - do:
+      index:
+        index: logs-generic-default
+        refresh: true
+        body:
+          test: 'doc-with-ip'
+          socket:
+            ip: 127.0.0.1
+  - match: {result: "created"}
+
+  - do:
+      search:
+        index: logs-generic-default
+        body:
+          query:
+            term:
+              test:
+                value: 'doc-with-ip'
+          fields:
+            - field: 'socket.ip'
+  - length: { hits.hits: 1 }
+  - match: { hits.hits.0._source.socket.ip: '127.0.0.1' }
+
+  - do:
+      indices.get_mapping:
+        index: $idx0name
+  # test overriding of ECS dynamic template
+  - match: { .$idx0name.mappings.properties.socket.properties.ip.type: "keyword" }
+