Skip to content

Generator does not add "ignore_above" property for field type: flattened #2237

@brett-fitz

Description

@brett-fitz

Description of the problem including expected versus actual behavior:
Generator does not write the property: ignore_above for field type: flattened

Steps to reproduce:

Create a field in a field set that is flattened with the ignore above key

    - name: enrichment_data
      level: custom
      type: flattened
      description: >-
        Flattened object of enrichment data.
      ignore_above: 1024

Please include a minimal but complete recreation of the problem.

  1. Created field set ecs file
  2. Added field set to subset.yml
  3. Generated artifacts
  4. Examine generated component template with flattened field.

Provide logs (if relevant):

Generated component template

{
  "_meta": {
    "ecs_version": "8.8.0"
  },
  "template": {
    "mappings": {
      "properties": {
        "enrichment_data": {
          "type": "flattened"
        }
      }
    }
  }
}

Any additional context:
This key is necessary so elasticsearch does not try to index fields with large values.

Note: Adding the property after the component template is generated works as a temporary workaround.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions