Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Auditbeat] file.origin and file.origin.raw multi-fields are both keyword #12423

Closed
andrewkroh opened this issue Jun 4, 2019 · 1 comment · Fixed by #15630
Closed

[Auditbeat] file.origin and file.origin.raw multi-fields are both keyword #12423

andrewkroh opened this issue Jun 4, 2019 · 1 comment · Fixed by #15630
Labels
Auditbeat bug

Comments

@andrewkroh
Copy link
Member

As of #10544 both file.origin and file.origin.raw are both keyword type. The idea behind having a multi-field is to allow one of the fields to be analyzed to help with searching.

To fix the issue we should remove file.origin.raw and add file.origin.text that is text. This would follow the ECS convention.
@elasticmachine
Copy link
Collaborator

Pinging @elastic/siem (Team:SIEM)

@adriansr adriansr mentioned this issue Jan 17, 2020
Merged
adriansr added a commit to adriansr/beats that referenced this issue Mar 2, 2020
@adriansr
[Auditbeat] macOS: Replace file.origin.raw with file.origin.text
e36d635 
The `raw` part of the multifield was unnecessary because it was keyword
like the base field. Replaced with `file.origin.text` of type text as
ECS recommends.

Fixes elastic#12423
adriansr added a commit that referenced this issue Mar 3, 2020
@adriansr
[Auditbeat] macOS: Replace file.origin.raw with file.origin.text (#15630
68e9bd3 
)

The `raw` part of the multifield was unnecessary because it was keyword
like the base field. Replaced with `file.origin.text` of type text as
ECS recommends.

Fixes #12423
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Auditbeat bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

[Auditbeat] macOS: Replace file.origin.raw with file.origin.text adriansr/beats
3 participants
@andresrc @andrewkroh @elasticmachine