-
Notifications
You must be signed in to change notification settings - Fork 73
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Introduce "external" property for fields #179
Conversation
💚 Build Succeeded
Expand to view the summary
Build stats
Trends 🧪 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good, added only some questions.
Do you have by chance already started on the actual elastic-package PR that will use this If this PR is blocking to get you moving on the elastic-package implementation, please get it in. Over LGTM. |
I can start drafting something aside and then we can decide on naming. In general I need two spec PRs, this and one which adds "buildDependencies" property to the package manifest (see comment: #63 (comment)). I will prepare the second spec PR and then switch to implementation. It might be tricky (and time consuming) to develop as I need to checkout ECS registry, so it would be helpful if we agree on the spec changes sooner than later. I'm also happy to review other ideas. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sorry for the late review comment, seems I didn't hit submit before ...
description: Event family | ||
fields: | ||
- name: category | ||
source: ecs |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It's kind of a nitpick but I still want to mention it. The term source
comes with a lot of baggage. It has some history in filebeat and is also used in ecs.
Do we expect any other source
in the future? Or could we start with ecs: true
or something like that for now?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Alternative name: reference: ecs
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we expect any other source in the future?
Yes, as described in #63 (comment) . We'd like to introduce similar fields schema for Agent's fields.
Alternative name: reference: ecs ?
I can adjust to reference
. I wasn't aware of the history.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Renamed, although I believe this is more like personal preference.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Agree, not happy with both names :-D Especially as source
sounds technically more correct. Maybe it is just me that gets reminded of all the history here.
@@ -78,9 +78,13 @@ spec: | |||
type: string | |||
examples: | |||
- '^[a-zA-Z]$' | |||
reference: | |||
description: External source reference |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Haha, both names are in here 🤦 source and reference.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Another option:
external: ecs
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ok, I renamed to external
.
Sorry for the late comment and if this complicates things a bit more, but don't we need more information for the source? E.g. if we are talking ECS, the author should select a version. In a more general case (assuming we have some file defining a field "library") we would need the URL to that "library" (and probably a content hash for reproducible builds) Does this make sense? |
Yes, that's true. The |
What does this PR do?
This PR introduces additional "external" property for fields.
Why is it important?
The property will be used by elastic-package to pull the definition from ECS repository.
Checklist
test/packages
that prove my change is effective.versions/N/changelog.yml
.Related issues