x-pack/plugin/core: add match_mapping_type to ecs@mappings dynam…

…ic templates (elastic#103035) Add `match_mapping_type` to `ecs@mappings`'s `ecs_usage_scaled_float` (now split into two) dynamic templates, to avoid matching intermediate objects. For example, this avoids matching the `usage` object in `system.process.cgroup.memory.mem.usage.bytes`. This is a short term solution for elastic#102794, to unblock using the apm-data plugin (whose templates include `ecs@mappings`). A better solution (compared to splitting the `ecs_usage_scaled_float` template) would be elastic#102807.
jpountz · Dec 12, 2023 · ad9a054 · ad9a054
1 parent a83b78e
commit ad9a054
Show file tree

Hide file tree

Showing 4 changed files with 61 additions and 3 deletions.
diff --git a/docs/changelog/103035.yaml b/docs/changelog/103035.yaml
@@ -0,0 +1,5 @@
+pr: 103035
+summary: "x-pack/plugin/core: add `match_mapping_type` to `ecs@mappings` dynamic templates"
+area: Data streams
+type: bug
+issues: []
diff --git a/x-pack/plugin/core/template-resources/src/main/resources/[email protected] b/x-pack/plugin/core/template-resources/src/main/resources/[email protected]
@@ -143,12 +143,33 @@
           }
         },
         {
-          "ecs_usage_scaled_float": {
+          "ecs_usage_double_scaled_float": {
             "mapping": {
               "type": "scaled_float",
               "scaling_factor": 1000
             },
-            "path_match": "*.usage"
+            "path_match": "*.usage",
+            "match_mapping_type": "double"
+          }
+        },
+        {
+          "ecs_usage_long_scaled_float": {
+            "mapping": {
+              "type": "scaled_float",
+              "scaling_factor": 1000
+            },
+            "path_match": "*.usage",
+            "match_mapping_type": "long"
+          }
+        },
+        {
+          "ecs_usage_long_scaled_float": {
+            "mapping": {
+              "type": "scaled_float",
+              "scaling_factor": 1000
+            },
+            "path_match": "*.usage",
+            "match_mapping_type": "string"
           }
         },
         {

diff --git a/...ugin/stack/src/javaRestTest/java/org/elasticsearch/xpack/stack/EcsDynamicTemplatesIT.java b/...ugin/stack/src/javaRestTest/java/org/elasticsearch/xpack/stack/EcsDynamicTemplatesIT.java
@@ -182,6 +182,38 @@ public void testNestedFields() throws IOException {
         verifyEcsMappings(indexName);
     }
 
+    public void testNumericMessage() throws IOException {
+        String indexName = "test-numeric-message";
+        createTestIndex(indexName);
+        Map<String, Object> fieldsMap = createTestDocument(false);
+        fieldsMap.put("message", 123); // Should be mapped as match_only_text
+        indexDocument(indexName, fieldsMap);
+        verifyEcsMappings(indexName);
+    }
+
+    public void testUsage() throws IOException {
+        String indexName = "test-usage";
+        createTestIndex(indexName);
+        Map<String, Object> fieldsMap = createTestDocument(false);
+        // Only non-root numeric (or coercable to numeric) "usage" fields should match
+        // ecs_usage_*_scaled_float; root fields and intermediate object fields should not match.
+        fieldsMap.put("host.cpu.usage", 123); // should be mapped as scaled_float
+        fieldsMap.put("string.usage", "123"); // should also be mapped as scale_float
+        fieldsMap.put("usage", 123);
+        fieldsMap.put("root.usage.long", 123);
+        fieldsMap.put("root.usage.float", 123.456);
+        indexDocument(indexName, fieldsMap);
+
+        final Map<String, Object> rawMappings = getMappings(indexName);
+        final Map<String, String> flatFieldMappings = new HashMap<>();
+        processRawMappingsSubtree(rawMappings, flatFieldMappings, new HashMap<>(), "");
+        assertEquals("scaled_float", flatFieldMappings.get("host.cpu.usage"));
+        assertEquals("scaled_float", flatFieldMappings.get("string.usage"));
+        assertEquals("long", flatFieldMappings.get("usage"));
+        assertEquals("long", flatFieldMappings.get("root.usage.long"));
+        assertEquals("float", flatFieldMappings.get("root.usage.float"));
+    }
+
     private static void indexDocument(String indexName, Map<String, Object> flattenedFieldsMap) throws IOException {
         try (XContentBuilder bodyBuilder = JsonXContent.contentBuilder()) {
             Request indexRequest = new Request("POST", "/" + indexName + "/_doc");

diff --git a/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java b/x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java
@@ -43,7 +43,7 @@ public class StackTemplateRegistry extends IndexTemplateRegistry {
 
     // The stack template registry version. This number must be incremented when we make changes
     // to built-in templates.
-    public static final int REGISTRY_VERSION = 4;
+    public static final int REGISTRY_VERSION = 5;
 
     public static final String TEMPLATE_VERSION_VARIABLE = "xpack.stack.template.version";
     public static final Setting<Boolean> STACK_TEMPLATES_ENABLED = Setting.boolSetting(