feat(falco-sidekick-ES): Update default value of ES.type

In prevision of sidekick version bump. falcosecurity/falcosidekick#349 Signed-off-by: Lyonel Martinez <lyonel.martinez@numberly.com>
falcosecurity · Jul 27, 2022 · 79bc3ff · 79bc3ff
1 parent a1135fd
commit 79bc3ff
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 2 deletions.
diff --git a/falcosidekick/CHANGELOG.md b/falcosidekick/CHANGELOG.md
@@ -13,6 +13,7 @@ as a list of comma separated labels and annotations to add to the AlertManager t
 * Add `yandex.datastreams` and associated fields.
 * Add `nodered` and associated fields.
 * Add `mqtt` and associated fields.
+* Update `elasticsearch.type` default value to `_doc`
 
 ## 0.5.6
 

diff --git a/falcosidekick/README.md b/falcosidekick/README.md
@@ -205,7 +205,7 @@ The following table lists the main configurable parameters of the Falcosidekick
 | `config.elasticsearch.minimumpriority`      | minimum priority of event for using use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`                                         | `debug`                                                                                                    |
 | `config.elasticsearch.mutualtls`            | if true, checkcert flag will be ignored (server cert will always be checked)                                                                                                           | `false`                                                                                                    |
 | `config.elasticsearch.password`             | use this password to authenticate to Elasticsearch if the password is not empty                                                                                                        | `""`                                                                                                       |
-| `config.elasticsearch.type`                 | Elasticsearch document type                                                                                                                                                            | `event`                                                                                                    |
+| `config.elasticsearch.type`                 | Elasticsearch document type                                                                                                                                                            | `_doc`                                                                                                     |
 | `config.elasticsearch.username`             | use this username to authenticate to Elasticsearch if the username is not empty                                                                                                        | `""`                                                                                                       |
 | `config.fission.checkcert`                  | check if ssl certificate of the output is valid                                                                                                                                        | `true`                                                                                                     |
 | `config.fission.function`                   | Name of Fission function, if not empty, Fission is *enabled*                                                                                                                           | `""`                                                                                                       |

diff --git a/falcosidekick/values.yaml b/falcosidekick/values.yaml
@@ -94,7 +94,7 @@ config:
   elasticsearch:
     hostport: ""
     index: "falco"
-    type: "event"
+    type: "_doc"
     minimumpriority: ""
     mutualtls: false
     checkcert: true