[fix] move from keyword to wildcards for ECS fields (elastic#4577)

Align type with ECS types for overwritten fields. closes elastic#4448
simitt · Dec 28, 2020 · 79a0e5a · 79a0e5a
1 parent 4175c2a
commit 79a0e5a
Show file tree

Hide file tree

Showing 13 changed files with 384 additions and 336 deletions.
diff --git a/apmpackage/apm/0.1.0/data_stream/app_metrics/fields/ecs.yml b/apmpackage/apm/0.1.0/data_stream/app_metrics/fields/ecs.yml
@@ -90,7 +90,7 @@
   description: |
     The architecture of the host the event was recorded on.
 - name: host.hostname
-  type: keyword
+  type: wildcard
   description: |
     The hostname of the host the event was recorded on.
 - name: host.ip
@@ -135,7 +135,7 @@
   description: |
     Numeric ID of the service's parent process.
 - name: process.title
-  type: keyword
+  type: wildcard
   description: |
     Service process title.
 - name: service.name
@@ -155,15 +155,15 @@
   description: |
     IP address of the source of a recorded event. This is typically obtained from a request's X-Forwarded-For or the X-Real-IP header or falls back to a given configuration for remote address.
 - name: user.email
-  type: keyword
+  type: wildcard
   description: |
     Email of the logged in user.
 - name: user.id
   type: keyword
   description: |
     Identifier of the logged in user.
 - name: user.name
-  type: keyword
+  type: wildcard
   description: |
     The username of the logged in user.
 - name: user_agent.device.name
@@ -175,7 +175,7 @@
   description: |
     Name of the user agent.
 - name: user_agent.original
-  type: keyword
+  type: wildcard
   description: |
     Unparsed version of the user_agent.
   multi_fields:
@@ -186,15 +186,15 @@
   description: |
     OS family (such as redhat, debian, freebsd, windows).
 - name: user_agent.os.full
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, including the version or code name.
 - name: user_agent.os.kernel
   type: keyword
   description: |
     Operating system kernel version as a raw string.
 - name: user_agent.os.name
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, without the version.
 - name: user_agent.os.platform

diff --git a/apmpackage/apm/0.1.0/data_stream/error_logs/fields/ecs.yml b/apmpackage/apm/0.1.0/data_stream/error_logs/fields/ecs.yml
@@ -94,7 +94,7 @@
   description: |
     The architecture of the host the event was recorded on.
 - name: host.hostname
-  type: keyword
+  type: wildcard
   description: |
     The hostname of the host the event was recorded on.
 - name: host.ip
@@ -114,7 +114,7 @@
   description: |
     The http method of the request leading to this event.
 - name: http.request.referrer
-  type: keyword
+  type: wildcard
   description: Referrer for this HTTP request.
   ignore_above: 1024
 - name: http.response.status_code
@@ -155,7 +155,7 @@
   description: |
     Numeric ID of the service's parent process.
 - name: process.title
-  type: keyword
+  type: wildcard
   description: |
     Service process title.
 - name: service.name
@@ -183,19 +183,19 @@
   description: |
     The transaction ID.
 - name: url.domain
-  type: keyword
+  type: wildcard
   description: |
     The hostname of the request, e.g. "example.com".
 - name: url.fragment
   type: keyword
   description: |
     A fragment specifying a location in a web page , e.g. "top".
 - name: url.full
-  type: keyword
+  type: wildcard
   description: |
     The full, possibly agent-assembled URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.
 - name: url.path
-  type: keyword
+  type: wildcard
   description: |
     The path of the request, e.g. "/search".
 - name: url.port
@@ -211,15 +211,15 @@
   description: |
     The protocol of the request, e.g. "https:".
 - name: user.email
-  type: keyword
+  type: wildcard
   description: |
     Email of the logged in user.
 - name: user.id
   type: keyword
   description: |
     Identifier of the logged in user.
 - name: user.name
-  type: keyword
+  type: wildcard
   description: |
     The username of the logged in user.
 - name: user_agent.device.name
@@ -231,7 +231,7 @@
   description: |
     Name of the user agent.
 - name: user_agent.original
-  type: keyword
+  type: wildcard
   description: |
     Unparsed version of the user_agent.
   multi_fields:
@@ -242,15 +242,15 @@
   description: |
     OS family (such as redhat, debian, freebsd, windows).
 - name: user_agent.os.full
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, including the version or code name.
 - name: user_agent.os.kernel
   type: keyword
   description: |
     Operating system kernel version as a raw string.
 - name: user_agent.os.name
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, without the version.
 - name: user_agent.os.platform

diff --git a/apmpackage/apm/0.1.0/data_stream/internal_metrics/fields/ecs.yml b/apmpackage/apm/0.1.0/data_stream/internal_metrics/fields/ecs.yml
@@ -96,7 +96,7 @@
   description: |
     The architecture of the host the event was recorded on.
 - name: host.hostname
-  type: keyword
+  type: wildcard
   description: |
     The hostname of the host the event was recorded on.
 - name: host.ip
@@ -141,7 +141,7 @@
   description: |
     Numeric ID of the service's parent process.
 - name: process.title
-  type: keyword
+  type: wildcard
   description: |
     Service process title.
 - name: service.name
@@ -165,15 +165,15 @@
   description: |
     The transaction ID.
 - name: user.email
-  type: keyword
+  type: wildcard
   description: |
     Email of the logged in user.
 - name: user.id
   type: keyword
   description: |
     Identifier of the logged in user.
 - name: user.name
-  type: keyword
+  type: wildcard
   description: |
     The username of the logged in user.
 - name: user_agent.device.name
@@ -185,7 +185,7 @@
   description: |
     Name of the user agent.
 - name: user_agent.original
-  type: keyword
+  type: wildcard
   description: |
     Unparsed version of the user_agent.
   multi_fields:
@@ -196,15 +196,15 @@
   description: |
     OS family (such as redhat, debian, freebsd, windows).
 - name: user_agent.os.full
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, including the version or code name.
 - name: user_agent.os.kernel
   type: keyword
   description: |
     Operating system kernel version as a raw string.
 - name: user_agent.os.name
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, without the version.
 - name: user_agent.os.platform

diff --git a/apmpackage/apm/0.1.0/data_stream/profile_metrics/fields/ecs.yml b/apmpackage/apm/0.1.0/data_stream/profile_metrics/fields/ecs.yml
@@ -90,7 +90,7 @@
   description: |
     The architecture of the host the event was recorded on.
 - name: host.hostname
-  type: keyword
+  type: wildcard
   description: |
     The hostname of the host the event was recorded on.
 - name: host.ip
@@ -135,7 +135,7 @@
   description: |
     Numeric ID of the service's parent process.
 - name: process.title
-  type: keyword
+  type: wildcard
   description: |
     Service process title.
 - name: service.name
@@ -155,15 +155,15 @@
   description: |
     IP address of the source of a recorded event. This is typically obtained from a request's X-Forwarded-For or the X-Real-IP header or falls back to a given configuration for remote address.
 - name: user.email
-  type: keyword
+  type: wildcard
   description: |
     Email of the logged in user.
 - name: user.id
   type: keyword
   description: |
     Identifier of the logged in user.
 - name: user.name
-  type: keyword
+  type: wildcard
   description: |
     The username of the logged in user.
 - name: user_agent.device.name
@@ -175,7 +175,7 @@
   description: |
     Name of the user agent.
 - name: user_agent.original
-  type: keyword
+  type: wildcard
   description: |
     Unparsed version of the user_agent.
   multi_fields:
@@ -186,15 +186,15 @@
   description: |
     OS family (such as redhat, debian, freebsd, windows).
 - name: user_agent.os.full
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, including the version or code name.
 - name: user_agent.os.kernel
   type: keyword
   description: |
     Operating system kernel version as a raw string.
 - name: user_agent.os.name
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, without the version.
 - name: user_agent.os.platform

diff --git a/apmpackage/apm/0.1.0/data_stream/traces/fields/ecs.yml b/apmpackage/apm/0.1.0/data_stream/traces/fields/ecs.yml
@@ -96,7 +96,7 @@
   description: |
     The architecture of the host the event was recorded on.
 - name: host.hostname
-  type: keyword
+  type: wildcard
   description: |
     The hostname of the host the event was recorded on.
 - name: host.ip
@@ -116,7 +116,7 @@
   description: |
     The http method of the request leading to this event.
 - name: http.request.referrer
-  type: keyword
+  type: wildcard
   description: Referrer for this HTTP request.
   ignore_above: 1024
 - name: http.response.status_code
@@ -157,7 +157,7 @@
   description: |
     Numeric ID of the service's parent process.
 - name: process.title
-  type: keyword
+  type: wildcard
   description: |
     Service process title.
 - name: service.name
@@ -189,19 +189,19 @@
   description: |
     The transaction ID.
 - name: url.domain
-  type: keyword
+  type: wildcard
   description: |
     The hostname of the request, e.g. "example.com".
 - name: url.fragment
   type: keyword
   description: |
     A fragment specifying a location in a web page , e.g. "top".
 - name: url.full
-  type: keyword
+  type: wildcard
   description: |
     The full, possibly agent-assembled URL of the request, e.g https://example.com:443/search?q=elasticsearch#top.
 - name: url.path
-  type: keyword
+  type: wildcard
   description: |
     The path of the request, e.g. "/search".
 - name: url.port
@@ -217,15 +217,15 @@
   description: |
     The protocol of the request, e.g. "https:".
 - name: user.email
-  type: keyword
+  type: wildcard
   description: |
     Email of the logged in user.
 - name: user.id
   type: keyword
   description: |
     Identifier of the logged in user.
 - name: user.name
-  type: keyword
+  type: wildcard
   description: |
     The username of the logged in user.
 - name: user_agent.device.name
@@ -237,7 +237,7 @@
   description: |
     Name of the user agent.
 - name: user_agent.original
-  type: keyword
+  type: wildcard
   description: |
     Unparsed version of the user_agent.
   multi_fields:
@@ -248,15 +248,15 @@
   description: |
     OS family (such as redhat, debian, freebsd, windows).
 - name: user_agent.os.full
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, including the version or code name.
 - name: user_agent.os.kernel
   type: keyword
   description: |
     Operating system kernel version as a raw string.
 - name: user_agent.os.name
-  type: keyword
+  type: wildcard
   description: |
     Operating system name, without the version.
 - name: user_agent.os.platform