Avoid false-positive matches on intermediate objects in ecs@template

felixbarny · Feb 13, 2024 · c1370f5 · c1370f5
1 parent e6e14d7
commit c1370f5
Show file tree

Hide file tree

Showing 2 changed files with 49 additions and 30 deletions.
diff --git a/x-pack/plugin/core/template-resources/src/main/resources/ecs@mappings.json b/x-pack/plugin/core/template-resources/src/main/resources/ecs@mappings.json
@@ -19,7 +19,8 @@
             "path_match": [
               "message",
               "*.message"
-            ]
+            ],
+            "unmatch_mapping_type": "object"
           }
         },
         {
@@ -45,7 +46,8 @@
               "*.message_id",
               "*registry.data.strings",
               "*url.path"
-            ]
+            ],
+            "unmatch_mapping_type": "object"
           }
         },
         {
@@ -62,7 +64,8 @@
               "*.body.content",
               "*url.full",
               "*url.original"
-            ]
+            ],
+            "unmatch_mapping_type": "object"
           }
         },
         {
@@ -78,7 +81,8 @@
             "match": [
               "*command_line",
               "*stack_trace"
-            ]
+            ],
+            "unmatch_mapping_type": "object"
           }
         },
         {
@@ -103,7 +107,8 @@
               "email.subject",
               "vulnerability.description",
               "user_agent.original"
-            ]
+            ],
+            "unmatch_mapping_type": "object"
           }
         },
         {
@@ -127,7 +132,8 @@
               "*.ingested",
               "*.start",
               "*.end"
-            ]
+            ],
+            "unmatch_mapping_type": "object"
           }
         },
         {
@@ -139,7 +145,8 @@
               "*.score.*",
               "*_score*"
             ],
-            "path_unmatch": "*.version"
+            "path_unmatch": "*.version",
+            "unmatch_mapping_type": "object"
           }
         },
         {
@@ -149,27 +156,7 @@
               "scaling_factor": 1000
             },
             "path_match": "*.usage",
-            "match_mapping_type": "double"
-          }
-        },
-        {
-          "ecs_usage_long_scaled_float": {
-            "mapping": {
-              "type": "scaled_float",
-              "scaling_factor": 1000
-            },
-            "path_match": "*.usage",
-            "match_mapping_type": "long"
-          }
-        },
-        {
-          "ecs_usage_long_scaled_float": {
-            "mapping": {
-              "type": "scaled_float",
-              "scaling_factor": 1000
-            },
-            "path_match": "*.usage",
-            "match_mapping_type": "string"
+            "match_mapping_type": ["double", "long", "string"]
           }
         },
         {
@@ -180,7 +167,8 @@
             "path_match": [
               "location",
               "*.location"
-            ]
+            ],
+            "match_mapping_type": ["object", "string"]
           }
         },
         {
@@ -192,7 +180,8 @@
               "*structured_data",
               "*exports",
               "*imports"
-            ]
+            ],
+            "match_mapping_type": "object"
           }
         },
         {

diff --git a/...ugin/stack/src/javaRestTest/java/org/elasticsearch/xpack/stack/EcsDynamicTemplatesIT.java b/...ugin/stack/src/javaRestTest/java/org/elasticsearch/xpack/stack/EcsDynamicTemplatesIT.java
@@ -214,6 +214,36 @@ public void testUsage() throws IOException {
         assertEquals("float", flatFieldMappings.get("root.usage.float"));
     }
 
+    public void testOnlyMatchLeafFields() throws IOException {
+        // tests that some of the match conditions only apply to leaf fields, not intermediate objects
+        String indexName = "test";
+        createTestIndex(indexName);
+        Map<String, Object> fieldsMap = createTestDocument(false);
+        fieldsMap.put("foo.message.bar", 123);
+        fieldsMap.put("foo.url.path.bar", 123);
+        fieldsMap.put("foo.url.full.bar", 123);
+        fieldsMap.put("foo.stack_trace.bar", 123);
+        fieldsMap.put("foo.user_agent.original.bar", 123);
+        fieldsMap.put("foo.created.bar", 123);
+        fieldsMap.put("foo._score.bar", 123);
+        fieldsMap.put("foo.location", 123);
+        fieldsMap.put("foo.structured_data", 123);
+        indexDocument(indexName, fieldsMap);
+
+        final Map<String, Object> rawMappings = getMappings(indexName);
+        final Map<String, String> flatFieldMappings = new HashMap<>();
+        processRawMappingsSubtree(rawMappings, flatFieldMappings, new HashMap<>(), "");
+        assertEquals("long", flatFieldMappings.get("foo.message.bar"));
+        assertEquals("long", flatFieldMappings.get("foo.url.path.bar"));
+        assertEquals("long", flatFieldMappings.get("foo.url.full.bar"));
+        assertEquals("long", flatFieldMappings.get("foo.stack_trace.bar"));
+        assertEquals("long", flatFieldMappings.get("foo.user_agent.original.bar"));
+        assertEquals("long", flatFieldMappings.get("foo.created.bar"));
+        assertEquals("float", flatFieldMappings.get("foo._score.bar"));
+        assertEquals("long", flatFieldMappings.get("foo.location"));
+        assertEquals("long", flatFieldMappings.get("foo.structured_data"));
+    }
+
     private static void indexDocument(String indexName, Map<String, Object> flattenedFieldsMap) throws IOException {
         try (XContentBuilder bodyBuilder = JsonXContent.contentBuilder()) {
             Request indexRequest = new Request("POST", "/" + indexName + "/_doc");