Add missing properties to fields.yml spec

test/packages/good/data_stream/foo/fields/some_fields.yml

@@ -35,3 +35,15 @@
 - name: error.message
   description: Error message.
   type: match_only_text
+- name: metric.*_bytes
+  type: long
+- name: a
+  type: nested
+  include_in_parent: true
+- name: a.b
+  type: keyword
+- name: c
+  type: nested
+  include_in_root: true
+- name: c.d
+  type: keyword

versions/1/changelog.yml

@@ -13,6 +13,9 @@
   - description: Prepare for support of multiple, independent package types. Require "type" to be present in manifest.
     type: enhancement
     link: https://github.com/elastic/package-spec/pull/323
+  - description: Define all fields properties currently supported.
+    type: enhancement
+    link: https://github.com/elastic/package-spec/pull/314
 - version: 1.7.0
   changes:
   - description: Add kibana/osquery-pack-asset

versions/1/integration/data_stream/fields/fields.spec.yml

@@ -9,11 +9,11 @@ spec:
     additionalProperties: true
     properties:
       name:
-        description: Name of field
-        type: string
-      title:
-        description: Title of field
+        description: >
+          Name of field. Names containing dots are automatically split into
+          sub-fields.
         type: string
+        pattern: '^[*_@A-Za-z0-9]+(\.[*_@A-Za-z0-9]+)*$'
       type:
         description: Datatype of field
         type: string
@@ -25,7 +25,7 @@ spec:
         - match_only_text
         - keyword
         - long
-        - integer
+        - integer # Fleet always maps this as 'long'.
         - short
         - byte
         - double
@@ -52,20 +52,33 @@ spec:
         - wildcard
         - version
         - unsigned_long
+
       description:
         description: Short description of field
         type: string
+
       value:
         description: The value to associate with a constant_keyword field.
         type: string
+
       metric_type:
-        description: Metric type
+        description: >
+          The metric type of a numeric field. This is attached to the
+          field as a `time_series_metric` mapping parameter. A gauge is a
+          single-value measurement that can go up or down over time, such as a
+          temperature. A counter is a single-value cumulative counter that only
+          goes up, such as the number of requests processed by a web server. By
+          default, no metric type is associated with a field.
         type: string
         enum:
         - counter
         - gauge
+
       unit:
-        description: Unit
+        description: >
+          Unit type to associate with a numeric field. This is attached to the
+          field as metadata (via `meta`). By default, a field does not have a
+          unit. The convention for percents is to use value 1 to mean 100%.
         type: string
         enum:
         - byte
@@ -77,22 +90,184 @@ spec:
         - ms
         - micros
         - nanos
+
       dimension:
-        description: Declare a field as dimension of time series
+        description: >
+          Declare a field as dimension of time series. This is
+          attached to the field as a `time_series_dimension` mapping parameter.
         type: boolean
         default: false
+
       pattern:
-        description: Regular expression pattern of the field value
+        description: >
+          Regular expression pattern matching the allowed values for the field.
+          This is used for development-time data validation.
         type: string
         examples:
           - '^[a-zA-Z]$'
+
       external:
         description: External source reference
         type: string
         enum:
           - ecs
+
       fields:
         description: Sub-fields, when type is group
         $ref: "#"     # JSON-schema syntax for pointing to the root of the schema
+
+      doc_values:
+        description: >
+          Controls whether doc values are enabled for a field. All fields which
+          support doc values have them enabled by default. If you are sure that
+          you don’t need to sort or aggregate on a field, or access the field
+          value from a script, you can disable doc values in order to save disk
+          space. You cannot disable doc values for wildcard fields.
+        type: boolean
+
+      index:
+        description: >
+          The index option controls whether field values are indexed. Fields
+          that are not indexed are typically not queryable.
+        type: boolean
+        default: true
+
+      copy_to:
+        description: >
+          The copy_to parameter allows you to copy the values of multiple fields
+          into a group field, which can then be queried as a single field.
+        type: string
+
+      enabled:
+        description: >
+          The enabled setting, which can be applied only to the top-level
+          mapping definition and to object fields, causes Elasticsearch to skip
+          parsing of the contents of the field entirely. The JSON can still be
+          retrieved from the _source field, but it is not searchable or stored
+          in any other way.
+        type: boolean
+
+      dynamic:
+        description: >
+          The dynamic parameter controls whether new fields are added
+          dynamically. It accepts the following values:
+
+          true -  New fields are added to the mapping (default).
+
+          runtime - New fields are added to the mapping as runtime fields. These
+          fields are not indexed, and are loaded from _source at query time.
+
+          false - New fields are ignored. These fields will not be indexed or
+          searchable, but will still appear in the _source field of returned
+          hits. These fields will not be added to the mapping, and new fields
+          must be added explicitly.
+
+          strict -  If new fields are detected, an exception is thrown and the
+          document is rejected. New fields must be explicitly added to the
+          mapping.
+        default: true
+        enum:
+          - true
+          - false
+          - strict
+          - runtime  # Not supported at this time by Fleet.
+
+      scaling_factor:
+        description: >
+          The scaling factor to use when encoding values. Values will be
+          multiplied by this factor at index time and rounded to the closest
+          long value. For instance, a scaled_float with a scaling_factor of 10
+          would internally store 2.34 as 23 and all search-time operations
+          (queries, aggregations, sorting) will behave as if the document had a
+          value of 2.3. High values of scaling_factor improve accuracy but also
+          increase space requirements. Only valid for 'type: scaled_float'.
+        type: integer
+        default: 1000
+
+      analyzer:
+        description: >
+          Name of the analyzer to use for indexing. Unless search_analyzer is
+          specified this analyzer is used for both indexing and searching.
+          Only valid for 'type: text'.
+        type: string
+
+      search_analyzer:
+        description: >
+          Name of the analyzer to use for searching. Only valid for 'type: text'.
+        type: string
+
+      multi_fields:
+        description: >
+          It is often useful to index the same field in different ways for
+          different purposes. This is the purpose of multi-fields. For instance,
+          a string field could be mapped as a text field for full-text search,
+          and as a keyword field for sorting or aggregations.
+
+          Fleet honors this for `keyword`, `text`, and `wildcard` types.
+        $ref: "#" # JSON-schema syntax for pointing to the root of the schema
+
+      null_value:
+        description: >
+          The null_value parameter allows you to replace explicit null values
+          with the specified value so that it can be indexed and searched.
+
+          A null value cannot be indexed or searched. When a field is set to
+          null, (or an empty array or an array of null values) it is treated as
+          though that field has no values.
+
+          The null_value needs to be the same data type as the field. For
+          instance, a long field cannot have a string null_value.
+
+          The null_value only influences how data is indexed, it doesn’t modify
+          the _source document.
+        examples:
+          - "NULL"
+
+      ignore_above:
+        description: >
+          Strings longer than the ignore_above setting will not be indexed or
+          stored. For arrays of strings, ignore_above will be applied for each
+          array element separately and string elements longer than ignore_above
+          will not be indexed or stored. Fleet honors this for `keyword` and
+          `wildcard` types. Defaults to 1024.
+        type: integer
+        default: 1024
+
+      object_type:
+        description: >
+          Required for `type: array` to specify the data type in the array.
+        type: string
+
+      path:
+        description: >
+          For alias type fields this is the path to the target field. Note that
+          this must be the full path, including any parent objects
+          (e.g. object1.object2.field).
+        type: string
+
+      normalizer:
+        description: >
+          Specifies the name of a normalizer to apply to keyword fields. A
+          simple normalizer called lowercase ships with elasticsearch and can be
+          used. Custom normalizers can be defined as part of analysis index
+          settings.
+        type: string
+
+      include_in_parent:
+        description: >
+          For nested field types, this specifies if all fields in the nested
+          object are also added to the parent document as standard (flat)
+          fields.
+        type: boolean
+        default: false
+
+      include_in_root:
+        description: >
+          For nested field types, this specifies if all fields in the nested
+          object are also added to the root document as standard (flat)
+          fields.
+        type: boolean
+        default: false
+
     required:
     - name