Validate that event.type is aligned with event.category

[jsoriano]

Fields like event.category in ECS define a list of allowed values for event.type, check that these values are aligned.

This check is only enabled for packages using at least format version 2.0.0.

Fixes #837.
Part of elastic/package-spec#399.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-09-08T10:12:04.566+0000

• Duration: 25 min 28 sec

Test stats 🧪

Test	Results
Failed	0
Passed	808
Skipped	0
Total	808

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[mtojek]

I admit that it wasn't easy to go through the logic :) Maybe it's the first symptom to refactor the fields code.

[jsoriano]

I admit that it wasn't easy to go through the logic :) Maybe it's the first symptom to refactor the fields code.

Yeah, this is the first time we need to validate the values of two fields at the same time, this is why I ended up passing the whole document through all the calls chain so when validating one field we can check the value of the other.

Two possible alternatives would be:

• Internally instantiate a document validator for each document, this validator could keep state for each document validation, or the document itself.
• Given that by now we only need this for the event.type and event.category fields, validate them explicitly in ValidateDocumentMap, but this would give special consideration to these fields, what can be tricky in the future if ECS decides to use expected_event_types in other fields apart of event.category.

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (33/33)	💚
Files	67.213% (82/122)	👍
Classes	62.941% (107/170)	👍
Methods	49.928% (349/699)	👍 0.36
Lines	33.355% (3151/9447)	👍 0.223
Conditionals	100.0% (0/0)	💚

[mtojek]

Frankly speaking, both propositions are rather hackish. I think that I'd rather keep your current proposal (PR).

[jsoriano]

Frankly speaking, both propositions are rather hackish. I think that I'd rather keep your current proposal (PR).

Yep, I also prefer the current approach even if not so nice to have to pass the document around.

[jsoriano]

Integration tests found an issue, event.type is defined as array in ECS. Fixed code and tests to cover this case. Apache package fixed, it was missing event.type in one data stream.

After this change I will start with #963.