Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Winlogbeat] Fix duplicated type entry #10373

Merged
merged 3 commits into from
Jan 29, 2019
Merged

[Winlogbeat] Fix duplicated type entry #10373

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3c13ae8
[Winlogbeat] Fix duplicated type entry
ruflin Jan 28, 2019
039a0f2
update fields
ruflin Jan 28, 2019
f6075d7
change to text
ruflin Jan 29, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion winlogbeat/_meta/fields.common.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,6 @@

- name: xml
type: keyword
type: text
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@andrewkroh Not sure which one was the original intention.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was text because the value is very long and similar to message. If you change it to keyword then ignore_above needs to be increased from our default.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If full text indexing is deemed important here, we should add it as a multi-field at eventlog.xml.text.

Increasing ignore_above wouldn't help much, I would think.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm also good with keeping this as text (I think at the moment it is text because yaml takes the last definition). I don't really see how this field would be used for aggregations or exact match queries.

required: false
description: >
The raw XML representation of the event obtained from Windows. This
Expand Down