Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] Fix fileset field namespacing #20170

Merged

Commits on Jul 22, 2020

  1. Fix fileset field prefixing

    When the fields.yml file is constructed it is done by appending files together and adding some indenting.
    In the case of Filebeat, a fileset's fields.yml is appended with an indent of 8 spaces to the module's fields.yml.
    This generally allows for all of the filesets fields to become children of the module.
    
    The problem we had was that the new filesets added in elastic#19713 expected that their fields would be root fields
    (not children to the module namespace). In cases where the module already existed and had declared
    a module namespace field in its fields.yml this resulted in unexpectedly namespaced fieldset fields
    (e.g. microsoft.rsa.* instead of rsa.*).
    
    The size of the x-pack/filebeat index-pattern is still large (915885 bytes), but not so large that it goes beyond the Kibana
    request payload limit.
    
    Fixes elastic#19965
    andrewkroh committed Jul 22, 2020
    Configuration menu
    Copy the full SHA
    be7c5e0 View commit details
    Browse the repository at this point in the history