Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Version control on index mapping #182231

Open
angorayc opened this issue May 1, 2024 · 2 comments
Open

Version control on index mapping #182231

angorayc opened this issue May 1, 2024 · 2 comments
Assignees
Labels
Feature:Data Health Quality Data health quality dashboard and related features Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore

Comments

@angorayc
Copy link
Contributor

angorayc commented May 1, 2024

Suggested requests

  1. Adding updated version / time will be helpful for data quality dashboard to highlight the changes of an mapping.
  2. What we can also do is to provide an option to allow user save their historical mappings, so we can render a mapping diff on the UI side and point out exactly which part of their mapping is changed.

There are two features that will be beneficial if we have "version control" to users mapping:

  1. This requirement is due to an issue that users mapping was changed unintentionally. With the "updated version/time" of the mapping, users can be indicated that their mapping was changed: [SecuritySolution][DataQualityDashboard] Require a way to check missing Multi-fields #179827
  2. Security Solution data quality dashboard is planning to save the users checking result after each time they run the check. It would be helpful if users could see which version of the mapping they were checking : https://github.com/elastic/security-team/issues/8527

Here is the current response of the get mapping api:

I created an index, it show me a created version
Screenshot 2024-04-25 at 12 16 55

I updated the index mapping, it wouldn't show me any information that indicates the mapping has changed expect the mapping itself. I'd hope that we can add a updated version and time to the get index api

Screenshot 2024-04-25 at 12 17 15

It'd be very help for user if we have the version updated according to the mapping changes, as from the SDH above, our user doesn't know which version of mappings they are checking and if it has been changed since created. So from the historical record of the data quality check result, they'll be able to know exactly which version of their mapping has problem.

Originally posted by @angorayc in #179827 (comment)

@botelastic botelastic bot added the needs-team Issues missing a team label label May 1, 2024
@angorayc angorayc added Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore Feature:Data Health Quality Data health quality dashboard and related features and removed needs-team Issues missing a team label labels May 1, 2024
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-threat-hunting-explore (Team:Threat Hunting:Explore)

@angorayc angorayc self-assigned this May 14, 2024
@angorayc angorayc changed the title Add "updated version/time" in index mapping meta Version control on index mapping May 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature:Data Health Quality Data health quality dashboard and related features Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Threat Hunting:Explore
Projects
None yet
Development

No branches or pull requests

2 participants