graphactivitylogs: Fix client|source.geo.location mapping#11102
graphactivitylogs: Fix client|source.geo.location mapping#11102zmoog merged 3 commits intoelastic:mainfrom
Conversation
|
According to the Client Fields and Source Fields ECS reference, we should map However, the - name: client.geo.location.lat
external: ecs
- name: client.geo.location.lon
external: ecs
- name: source.geo.location.lat
external: ecs
- name: source.geo.location.lon
external: ecsThat causes Elasticsearch to map the We should probably change the mapping to: - name: client.geo.location
external: ecs
- name: source.geo.location
external: ecsTo align these fields with ECS and produce the expected @kcreddy, are there specific reasons to use the |
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
provisioning |
3225.81 | 2398.08 | -827.73 (-25.66%) | 💔 |
To see the full report comment with /test benchmark fullreport
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
efd6
left a comment
There was a problem hiding this comment.
This needs a changelog and manifest update.
packages/azure/changelog.yml
Outdated
| - version: "1.14.1" | ||
| changes: | ||
| - description: Fix [client|source].geo.location ECS field mapping | ||
| type: enhancement |
There was a problem hiding this comment.
You labeled the PR as a bug and the patch version was incremented so all signals suggest this should be type: bugfix instead of enhancement. Can you confirm the intention.
There was a problem hiding this comment.
Hey Andrew, thanks for the heads up. This is a bug; updating the changelog classification accordingly.
💚 Build Succeeded
History
cc @zmoog |
|
) Align `client|source.geo.location` fields to ECS mapping. Users reported mapping exceptions due to Elasticsearch mapping the `client|source.geo.location` fields as `object` instead of `geo_point`. See elastic#10848 for more.
) Align `client|source.geo.location` fields to ECS mapping. Users reported mapping exceptions due to Elasticsearch mapping the `client|source.geo.location` fields as `object` instead of `geo_point`. See elastic#10848 for more.
Proposed commit message
Align
client|source.geo.locationfields to ECS mapping.Users reported mapping exceptions due to Elasticsearch mapping the
client|source.geo.locationfields asobjectinstead ofgeo_point. See #10848 for more.Checklist
changelog.ymlfile.Related issues