Page MenuHomePhabricator

ECS support for subkey typing when parent key is undefined
Closed, ResolvedPublic

Description

There is currently no way to enforce types on sub-fields of dynamic fields.

Index templates do not support wildcards in field definitions. E.g.

                       ˅ -- likely translates to a literal '*' string
- name: puppet.runtime.*.seconds
                         ˄ -- should be typed "half_float"
  level: custom
  type: half_float
  short: total number of seconds spent executing a specific resource
  description: total seconds spent executing a specific resource

We'll need a way to enforce typing on the sub-field of an undefined field.

Dynamic templates with path_match may be the solution. It will be imperative to describe accurately in documentation (short and description fields) what is going on in the defined parent key.

Event Timeline

Change 722966 had a related patch set uploaded (by Cwhite; author: Cwhite):

[operations/software/ecs@master] add dynamic_templates template rendering

https://gerrit.wikimedia.org/r/722966

Change 722966 merged by jenkins-bot:

[operations/software/ecs@master] add dynamic_templates template rendering

https://gerrit.wikimedia.org/r/722966

I'm pretty sure this was done via https://gerrit.wikimedia.org/r/722966

We an reopen if this is insufficient.