From 22c30d9f3a9d42495fc78086dbb250e1f363ee8a Mon Sep 17 00:00:00 2001 From: Jaime Soriano Pastor Date: Mon, 16 Dec 2024 13:23:17 +0100 Subject: [PATCH] Workaround issue with missing dynamic mapping in tines package (#12082) No dynamic mapping was being generated for tines.audit_log.inputs.inputs.options.*, and this package uses the tines.audit_log.inputs.inputs.options field directly, without having any mapping for it or its sub-properties. The workaround ensures that there is a mapping for tines.audit_log.inputs.inputs.* that serves for tines.audit_log.inputs.inputs.options as well as for its subobjects. The configured dynamic mapping was not being generated due to some issue in Fleet that we are investigating. We detected this issue while refactoring field mappings tests in elastic-package, more about this in elastic/elastic-package#2214[1]. [1]https://github.com/elastic/elastic-package/pull/2214#issuecomment-2536692641 Co-authored-by: Dan Kortschak --- packages/tines/changelog.yml | 5 +++++ packages/tines/data_stream/audit_logs/fields/fields.yml | 6 ++---- packages/tines/docs/README.md | 2 +- packages/tines/manifest.yml | 2 +- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/packages/tines/changelog.yml b/packages/tines/changelog.yml index 03ca26e521c..7bce64fe260 100644 --- a/packages/tines/changelog.yml +++ b/packages/tines/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.14.1" + changes: + - description: Workaround missing dynamic template for options fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/12082 - version: "1.14.0" changes: - description: Do not remove `event.original` in main ingest pipeline. diff --git a/packages/tines/data_stream/audit_logs/fields/fields.yml b/packages/tines/data_stream/audit_logs/fields/fields.yml index 16cb1973903..127b370e8a8 100644 --- a/packages/tines/data_stream/audit_logs/fields/fields.yml +++ b/packages/tines/data_stream/audit_logs/fields/fields.yml @@ -142,10 +142,6 @@ type: keyword - name: oauthUrl type: keyword - - name: options - type: object - object_type: keyword - object_type_mapping_type: "*" - name: options.createFormEmptyState type: boolean - name: readAccess @@ -166,6 +162,8 @@ type: long - name: value type: keyword + - name: "*" + type: keyword - name: request_ip type: keyword description: The IP Address the operation was triggered from diff --git a/packages/tines/docs/README.md b/packages/tines/docs/README.md index 8b27b08498b..f58ffebd73c 100644 --- a/packages/tines/docs/README.md +++ b/packages/tines/docs/README.md @@ -76,6 +76,7 @@ All fields ingested to this data stream are stored under `tines.audit_log` as ea | tines.audit_log.inputs.actionIds | | long | | tines.audit_log.inputs.diagramNoteIds | | long | | tines.audit_log.inputs.fieldId | | long | +| tines.audit_log.inputs.inputs.\* | | keyword | | tines.audit_log.inputs.inputs.actionId | | long | | tines.audit_log.inputs.inputs.actionIds | | long | | tines.audit_log.inputs.inputs.actions.actionId | | long | @@ -125,7 +126,6 @@ All fields ingested to this data stream are stored under `tines.audit_log` as ea | tines.audit_log.inputs.inputs.oauthScope | | keyword | | tines.audit_log.inputs.inputs.oauthTokenUrl | | keyword | | tines.audit_log.inputs.inputs.oauthUrl | | keyword | -| tines.audit_log.inputs.inputs.options | | object | | tines.audit_log.inputs.inputs.options.createFormEmptyState | | boolean | | tines.audit_log.inputs.inputs.readAccess | | keyword | | tines.audit_log.inputs.inputs.required | | boolean | diff --git a/packages/tines/manifest.yml b/packages/tines/manifest.yml index e060ce22743..54468feb815 100644 --- a/packages/tines/manifest.yml +++ b/packages/tines/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.2.1 name: tines title: "Tines" -version: "1.14.0" +version: "1.14.1" description: "Tines Logs & Time Saved Reports" type: integration categories: