From 977124a70a8ebebb4ed33d34f6bf00a9a1f7ed9f Mon Sep 17 00:00:00 2001
From: neptunian <sandra.gonzales@elastic.co>
Date: Thu, 23 Jan 2020 13:15:15 -0500
Subject: [PATCH] skip fields that are disabled

---
 .../index_pattern/__snapshots__/install.test.ts.snap  | 11 +++++++++++
 .../epm/server/lib/kibana/index_pattern/install.ts    |  7 +++++--
 .../lib/kibana/index_pattern/tests/nginx.fields.yml   |  8 +++++++-
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/__snapshots__/install.test.ts.snap b/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/__snapshots__/install.test.ts.snap
index 1fdea8c07337b..80c8fe79c4162 100644
--- a/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/__snapshots__/install.test.ts.snap
+++ b/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/__snapshots__/install.test.ts.snap
@@ -115,6 +115,17 @@ exports[`creating index patterns from yaml fields dedupFields function remove du
     "type": "group",
     "description": "Contains fields for the Nginx access logs.\\n",
     "fields": [
+      {
+        "name": "group_disabled",
+        "type": "group",
+        "enabled": false,
+        "fields": [
+          {
+            "name": "message",
+            "type": "text"
+          }
+        ]
+      },
       {
         "name": "remote_ip_list",
         "type": "array",
diff --git a/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/install.ts b/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/install.ts
index c28ca637e8ee7..2c1a9eae6656c 100644
--- a/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/install.ts
+++ b/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/install.ts
@@ -200,9 +200,12 @@ export const transformField = (field: Field, i: number, fields: Fields): IndexPa
 export const flattenFields = (allFields: Fields): Fields => {
   const flatten = (fields: Fields): Fields =>
     fields.reduce<Field[]>((acc, field) => {
+      // recurse through nested fields
       if (field.type === 'group' && field.fields?.length) {
-        // look for nested fields
-        acc = renameAndFlatten(field, field.fields, [...acc]);
+        // skip if field.enabled is not explicitly set to false
+        if (!field.hasOwnProperty('enabled') || field.enabled === true) {
+          acc = renameAndFlatten(field, field.fields, [...acc]);
+        }
       } else {
         // handle alias type fields
         if (field.type === 'alias' && field.path) {
diff --git a/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/tests/nginx.fields.yml b/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/tests/nginx.fields.yml
index 33f51458706a4..220225a2c246b 100644
--- a/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/tests/nginx.fields.yml
+++ b/x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/tests/nginx.fields.yml
@@ -3,6 +3,12 @@
   description: >
     Contains fields for the Nginx access logs.
   fields:
+    - name: group_disabled
+      type: group
+      enabled: false
+      fields:
+        - name: message
+          type: text
     - name: remote_ip_list
       type: array
       description: >
@@ -109,4 +115,4 @@
     - name: keyword
       type: keyword
     - name: text
-      type: text
\ No newline at end of file
+      type: text