diff --git a/modules/data-streams/src/javaRestTest/java/org/elasticsearch/datastreams/LogsDataStreamIT.java b/modules/data-streams/src/javaRestTest/java/org/elasticsearch/datastreams/LogsDataStreamIT.java index 4c8d1bd41694f..5bb9c8b340ee9 100644 --- a/modules/data-streams/src/javaRestTest/java/org/elasticsearch/datastreams/LogsDataStreamIT.java +++ b/modules/data-streams/src/javaRestTest/java/org/elasticsearch/datastreams/LogsDataStreamIT.java @@ -101,6 +101,87 @@ public void testDefaultLogsSettingAndMapping() throws Exception { } } + @SuppressWarnings("unchecked") + public void testCustomMapping() throws Exception { + RestClient client = client(); + waitForLogs(client); + + { + Request request = new Request("POST", "/_component_template/logs@custom"); + request.setJsonEntity(""" + { + "template": { + "settings": { + "index": { + "query": { + "default_field": ["custom-message"] + } + } + }, + "mappings": { + "properties": { + "numeric_field": { + "type": "integer" + }, + "socket": { + "properties": { + "ip": { + "type": "keyword" + } + } + } + } + } + } + } + """); + assertOK(client.performRequest(request)); + } + + String dataStreamName = "logs-generic-default"; + createDataStream(client, dataStreamName); + String backingIndex = getWriteBackingIndex(client, dataStreamName); + + // Verify that the custom settings.index.query.default_field overrides the default query field - "message" + Map settings = getSettings(client, backingIndex); + assertThat(settings.get("index.query.default_field"), is(List.of("custom-message"))); + + // Verify that the new field from the custom component template is applied + putMapping(client, backingIndex); + Map mappingProperties = getMappingProperties(client, backingIndex); + assertThat(((Map) mappingProperties.get("numeric_field")).get("type"), equalTo("integer")); + assertThat( + ((Map) mappingProperties.get("socket")).get("properties"), + equalTo(Map.of("ip", Map.of("type", "keyword"))) + ); + + // Insert valid doc and verify successful indexing + { + indexDoc(client, dataStreamName, """ + { + "test": "doc-with-ip", + "socket": { + "ip": "127.0.0.1" + } + } + """); + List results = searchDocs(client, dataStreamName, """ + { + "query": { + "term": { + "test": { + "value": "doc-with-ip" + } + } + }, + "fields": ["socket.ip"] + } + """); + Map fields = ((Map>) results.get(0)).get("_source"); + assertThat(fields.get("socket"), is(Map.of("ip", "127.0.0.1"))); + } + } + @SuppressWarnings("unchecked") public void testLogsDefaultPipeline() throws Exception { RestClient client = client(); diff --git a/modules/data-streams/src/yamlRestTest/resources/rest-api-spec/test/data_stream/210_logs_custom_mappings.yml b/modules/data-streams/src/yamlRestTest/resources/rest-api-spec/test/data_stream/210_logs_custom_mappings.yml deleted file mode 100644 index 27d524c55d6e5..0000000000000 --- a/modules/data-streams/src/yamlRestTest/resources/rest-api-spec/test/data_stream/210_logs_custom_mappings.yml +++ /dev/null @@ -1,71 +0,0 @@ ---- -"Basic logs@custom component template functionality test": - - do: - cluster.put_component_template: - name: logs@custom - body: - template: - settings: - index: - query: - default_field: [ "custom-message" ] - mappings: - properties: - numeric_field: - type: integer - socket: - properties: - ip: - type: keyword - - - do: - indices.create_data_stream: - name: logs-generic-default - - is_true: acknowledged - - - do: - indices.get_data_stream: - name: logs-generic-default - - set: { data_streams.0.indices.0.index_name: idx0name } - - - do: - indices.get_settings: - index: $idx0name - # verify that the custom settings.index.query.default_field overrides the default query field - "message" - - match: { .$idx0name.settings.index.query.default_field: ["custom-message"] } - - - do: - indices.get_mapping: - index: $idx0name - # verify that the new field from the custom component template is applied - - match: { .$idx0name.mappings.properties.numeric_field.type: "integer" } - - - do: - index: - index: logs-generic-default - refresh: true - body: - test: 'doc-with-ip' - socket: - ip: 127.0.0.1 - - match: {result: "created"} - - - do: - search: - index: logs-generic-default - body: - query: - term: - test: - value: 'doc-with-ip' - fields: - - field: 'socket.ip' - - length: { hits.hits: 1 } - - match: { hits.hits.0._source.socket.ip: '127.0.0.1' } - - - do: - indices.get_mapping: - index: $idx0name - # test overriding of ECS dynamic template - - match: { .$idx0name.mappings.properties.socket.properties.ip.type: "keyword" } -