-
Notifications
You must be signed in to change notification settings - Fork 447
Closed
Labels
bugSomething isn't workingSomething isn't working
Description
Description of the problem including expected versus actual behavior:
Generator does not write the property: ignore_above
for field type: flattened
Steps to reproduce:
Create a field in a field set that is flattened with the ignore above key
- name: enrichment_data
level: custom
type: flattened
description: >-
Flattened object of enrichment data.
ignore_above: 1024
Please include a minimal but complete recreation of the problem.
- Created field set ecs file
- Added field set to subset.yml
- Generated artifacts
- Examine generated component template with flattened field.
Provide logs (if relevant):
Generated component template
{
"_meta": {
"ecs_version": "8.8.0"
},
"template": {
"mappings": {
"properties": {
"enrichment_data": {
"type": "flattened"
}
}
}
}
}
Any additional context:
This key is necessary so elasticsearch does not try to index fields with large values.
Note: Adding the property after the component template is generated works as a temporary workaround.
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working