You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Multiple field types support the dimension boolean parameter after the introduction of TSDB (dimensions used for routing purposes). There are integrations sharing component and composable templates and creating index templates, with field mappings that are shared in case a filed is used both for metrics and logging integrations. As a result, it is possible that a mapping defining dimension: true on a field is used when index mode is standard, time_series or logsdb. We do not want to prevent this sharing to happen because that would lead to many more composable/component/index templates to maintain for integrations. As a result, the idea is to just ignore the dimension parameter when not applicable (index.mode != time_series`).
This happens specifically with Otel mappings, which use shared mappings for logs and metrics which means some fields are declared as dimensions just because those fields are also used when the index mode is time_series. Because of this, anyway, multi-valued dimension fields trigger a validation error when index mode is logsdb (and standard). Multi-valued fields being disallowed should only happen in the context of metrics anyway. See #112232
We have different options to fix this:
ignore the dimension attribute in mappers when index mode is not time_series (doing this is a bit painful for every mapper, the suggestion is to extract common behaviour in a parent class).
always return empty dimensions when index mode is not time_series
NOTE: this can cause integrations to break when moving to LogsDB in case multi-value attributes are written.
The text was updated successfully, but these errors were encountered:
Description
Multiple field types support the
dimension
boolean parameter after the introduction of TSDB (dimensions used for routing purposes). There are integrations sharing component and composable templates and creating index templates, with field mappings that are shared in case a filed is used both for metrics and logging integrations. As a result, it is possible that a mapping definingdimension: true
on a field is used when index mode isstandard
,time_series
orlogsdb
. We do not want to prevent this sharing to happen because that would lead to many more composable/component/index templates to maintain for integrations. As a result, the idea is to just ignore thedimension
parameter when not applicable (index.mode !=
time_series`).This happens specifically with Otel mappings, which use shared mappings for logs and metrics which means some fields are declared as dimensions just because those fields are also used when the index mode is
time_series
. Because of this, anyway, multi-valued dimension fields trigger a validation error when index mode islogsdb
(andstandard
). Multi-valued fields being disallowed should only happen in the context of metrics anyway. See #112232We have different options to fix this:
dimension
attribute in mappers when index mode is nottime_series
(doing this is a bit painful for every mapper, the suggestion is to extract common behaviour in a parent class).time_series
NOTE: this can cause integrations to break when moving to LogsDB in case multi-value attributes are written.
The text was updated successfully, but these errors were encountered: